Skip to content

Commit 2818c80

Browse files
Khuzaima05Khuzaima-ShakeelAk-skyvburckhardtAashiq-J
authored
feat: adding option to specific explicit name for cbr rule and zone (#313)
Co-authored-by: Khuzaima-Shakeel <[email protected]> Co-authored-by: Akash Kumar <[email protected]> Co-authored-by: Vincent Burckhardt <[email protected]> Co-authored-by: [email protected] <[email protected]>
1 parent bf198ce commit 2818c80

File tree

7 files changed

+97
-39
lines changed

7 files changed

+97
-39
lines changed

‎.secrets.baseline‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"files": "go.sum|^.secrets.baseline$",
44
"lines": null
55
},
6-
"generated_at": "2023-12-11T10:56:30Z",
6+
"generated_at": "2024-01-16T11:01:35Z",
77
"plugins_used": [
88
{
99
"name": "AWSKeyDetector"

‎common-dev-assets‎

‎examples/fscloud/README.md‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,16 +2,19 @@
22

33
This example demonstrates how to use the [fscloud profile](../../profiles/fscloud/) module to lay out a complete "secure by default" coarse-grained CBR topology in a given account.
44

5-
This examples is designed to show case some of the key customization options for the module. In addition to the pre-wired CBR rules documented at [fscloud profile](../../profiles/fscloud/), this example shows how to customize the module to:
6-
1. Open up network traffic flow from Schematics to Key Protect and HPCS public endpoints. Note that for illustration purpose, this example configures the use of both Key Protect and HPCS through the `kms_service_targeted_by_prewired_rules` variable. In a real-world scenario, only one Key Management Service would be used
7-
2. Open up network traffic flow from a block of IPs to the Schematics public endpoint and the private container clusters endpoints.
8-
3. Open up network traffic flow from the VPC created in this example to ICD postgresql private endpoints.
5+
This examples is designed to show case some of the key customization options for the module. In addition to the pre-wired CBR rules documented at [fscloud profile](../../profiles/fscloud/), this examples show how to customize the module to:
6+
1. Open up network traffic flow from ICD mongodb, ICD Postgresql to the Key Protect private endpoints.
7+
2. Open up network traffic flow from Schematics to Key Protect public endpoints.
8+
3. Open up network traffic flow from a block of IPs to the Schematics public endpoint.
9+
4. Open up network traffic flow from the VPC created in this example to ICD postgresql private endpoints.
10+
5. Customize the rule description for `kms` and the zone name for `codeengine`.
911

1012
Context: this examples covers a "pseudo" real-world scenario where:
11-
1. Schematics is used to execute terraform that create Key Protect, and HPCS keys and key ring over its public endpoint.
12-
2. Operators use machines with a set list of public IPs to interact with Schematics, and through private endpoints to the container clusters.
13-
3. Applications are running the VPC and need access to PostgreSQL via the private endpoint - eg: a VPE.
14-
4. Skips creation of zones for these two service references ["user-management", "iam-groups"].
13+
1. ICD Mongodb and Postgresql instances are encrypted using keys storage in Key Protect.
14+
2. Schematics is used to execute terraform that create Key Protect keys and key ring over its public endpoint.
15+
3. Operators use machines with a set list of public IPs to interact with Schematics.
16+
4. Applications are running the VPC and need access to PostgreSQL via the private endpoint - eg: a VPE.
17+
5. Skips creation of zones for these two service references ["user-management", "iam-groups"].
1518

1619
## Note
1720
- The services 'compliance', 'directlink', 'iam-groups', 'containers-kubernetes', 'user-management' do not support restriction per location for zone creation.

‎examples/fscloud/main.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,20 @@ module "cbr_account_level" {
7373
target_service_details = {
7474
# Using 'kms' for Key Protect value as target service name supported by CBR for Key Protect is 'kms'.
7575
"kms" = {
76+
# Demonstrates how a customized CBR description (also seen as being the rule name) can be set
77+
"description" = "kms-rule-example-of-customized-description"
7678
"enforcement_mode" = "enabled"
7779
"instance_id" = module.key_protect_module.key_protect_guid
7880
}
81+
"cloud-object-storage" = {
82+
"enforcement_mode" = "enabled"
83+
"instance_id" = module.key_protect_module.key_protect_guid
84+
}
85+
}
86+
87+
# Demonstrates how a customized name can be set for the CBR zone
88+
zone_service_ref_list = {
89+
"codeengine" = "codeengine-zone-example-of-customized-zone-name"
7990
}
8091

8192
# Demonstrates how additional context to the rules created by this module can be added.

‎modules/fscloud/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -105,8 +105,8 @@ module "cbr_fscloud" {
105105
| <a name="input_location"></a> [location](#input\_location) | The region in which the network zone is scoped | `string` | `null` | no |
106106
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix to append to all vpc\_zone\_list, service\_ref\_zone\_list and cbr\_rule\_description created by this submodule | `string` | n/a | yes |
107107
| <a name="input_skip_specific_services_for_zone_creation"></a> [skip\_specific\_services\_for\_zone\_creation](#input\_skip\_specific\_services\_for\_zone\_creation) | Provide a list of service references for which zone creation is not required | `list(string)` | `[]` | no |
108-
| <a name="input_target_service_details"></a> [target\_service\_details](#input\_target\_service\_details) | Details of the target service for which a rule is created. The key is the service name. | <pre>map(object({<br> target_rg = optional(string)<br> instance_id = optional(string)<br> enforcement_mode = string<br> tags = optional(list(string))<br> }))</pre> | `{}` | no |
109-
| <a name="input_zone_service_ref_list"></a> [zone\_service\_ref\_list](#input\_zone\_service\_ref\_list) | (List) Service reference for the zone creation | `list(string)` | <pre>[<br> "cloud-object-storage",<br> "codeengine",<br> "containers-kubernetes",<br> "databases-for-cassandra",<br> "databases-for-elasticsearch",<br> "databases-for-enterprisedb",<br> "databases-for-etcd",<br> "databases-for-mongodb",<br> "databases-for-mysql",<br> "databases-for-postgresql",<br> "databases-for-redis",<br> "directlink",<br> "iam-groups",<br> "is",<br> "messagehub",<br> "messages-for-rabbitmq",<br> "schematics",<br> "secrets-manager",<br> "server-protect",<br> "user-management",<br> "apprapp",<br> "compliance",<br> "event-notifications",<br> "logdna",<br> "logdnaat"<br>]</pre> | no |
108+
| <a name="input_target_service_details"></a> [target\_service\_details](#input\_target\_service\_details) | Details of the target service for which a rule is created. The key is the service name. | <pre>map(object({<br> description = optional(string)<br> target_rg = optional(string)<br> instance_id = optional(string)<br> enforcement_mode = string<br> tags = optional(list(string))<br> }))</pre> | `{}` | no |
109+
| <a name="input_zone_service_ref_list"></a> [zone\_service\_ref\_list](#input\_zone\_service\_ref\_list) | (Optional) Customized name of the zone for the service reference. If not provided, default zone name with the prefix will be created. | <pre>object({<br> cloud-object-storage = optional(string)<br> codeengine = optional(string)<br> containers-kubernetes = optional(string)<br> databases-for-cassandra = optional(string)<br> databases-for-elasticsearch = optional(string)<br> databases-for-enterprisedb = optional(string)<br> databases-for-etcd = optional(string)<br> databases-for-mongodb = optional(string)<br> databases-for-mysql = optional(string)<br> databases-for-postgresql = optional(string)<br> databases-for-redis = optional(string)<br> directlink = optional(string)<br> iam-groups = optional(string)<br> is = optional(string)<br> messagehub = optional(string)<br> messages-for-rabbitmq = optional(string)<br> schematics = optional(string)<br> secrets-manager = optional(string)<br> server-protect = optional(string)<br> user-management = optional(string)<br> apprapp = optional(string)<br> compliance = optional(string)<br> event-notifications = optional(string)<br> logdna = optional(string)<br> logdnaat = optional(string)<br> })</pre> | <pre>{<br> "apprapp": null,<br> "cloud-object-storage": null,<br> "codeengine": null,<br> "compliance": null,<br> "containers-kubernetes": null,<br> "databases-for-cassandra": null,<br> "databases-for-elasticsearch": null,<br> "databases-for-enterprisedb": null,<br> "databases-for-etcd": null,<br> "databases-for-mongodb": null,<br> "databases-for-mysql": null,<br> "databases-for-postgresql": null,<br> "databases-for-redis": null,<br> "directlink": null,<br> "event-notifications": null,<br> "iam-groups": null,<br> "is": null,<br> "logdna": null,<br> "logdnaat": null,<br> "messagehub": null,<br> "messages-for-rabbitmq": null,<br> "schematics": null,<br> "secrets-manager": null,<br> "server-protect": null,<br> "user-management": null<br>}</pre> | no |
110110
| <a name="input_zone_vpc_crn_list"></a> [zone\_vpc\_crn\_list](#input\_zone\_vpc\_crn\_list) | (List) VPC CRN for the zones | `list(string)` | n/a | yes |
111111

112112
### Outputs

‎modules/fscloud/main.tf‎

Lines changed: 13 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -100,39 +100,37 @@ locals {
100100

101101
target_service_details = merge(local.target_service_details_default, var.target_service_details)
102102

103-
zone_final_service_ref_list = [
104-
for service in var.zone_service_ref_list : service if !contains(var.skip_specific_services_for_zone_creation, service)
105-
]
103+
zone_final_service_ref_list = {
104+
for service_ref, service_ref_name in var.zone_service_ref_list : service_ref => service_ref_name if !contains(var.skip_specific_services_for_zone_creation, service_ref)
105+
}
106106
}
107107

108108
###############################################################################
109109
# Pre-create coarse grained CBR zones for each service
110110
###############################################################################
111111

112112
locals {
113-
service_ref_zone_list = (length(local.zone_final_service_ref_list) > 0) ? [
114-
for serviceref in local.zone_final_service_ref_list : {
115-
name = "${var.prefix}-${serviceref}-service-zone"
113+
service_ref_zone_list = (length(local.zone_final_service_ref_list) > 0) ? {
114+
for service_ref, service_ref_name in local.zone_final_service_ref_list : service_ref => {
115+
name = service_ref_name == null ? "${var.prefix}-${service_ref}-service-zone" : service_ref_name
116116
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
117-
zone_description = "Single zone for service ${serviceref}."
117+
zone_description = "Single zone for service ${service_ref}."
118118
# when the target service is containers-kubernetes or any icd services, context cannot have a serviceref
119119
addresses = [
120120
{
121121
type = "serviceRef"
122122
ref = {
123123
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
124-
service_name = serviceref
125-
location = (serviceref == "compliance" || serviceref == "directlink" || serviceref == "iam-groups" || serviceref == "user-management" || serviceref == "containers-kubernetes") ? null : var.location
124+
service_name = service_ref
125+
location = (service_ref == "compliance" || service_ref == "directlink" || service_ref == "iam-groups" || service_ref == "user-management" || service_ref == "containers-kubernetes") ? null : var.location
126126
}
127127
}
128128
]
129-
}] : []
130-
131-
service_ref_zone_map_pre_check = zipmap(local.zone_final_service_ref_list, local.service_ref_zone_list)
129+
} } : {}
132130

133-
service_ref_zone_map_check = merge(local.service_ref_zone_map_pre_check, var.existing_serviceref_zone)
131+
service_ref_zone_map_check = merge(local.service_ref_zone_list, var.existing_serviceref_zone)
134132

135-
service_ref_zone_map = { for k, v in local.service_ref_zone_map_check : k => v if !contains(keys(v), "zone_id") }
133+
service_ref_zone_map = { for service_ref, service_ref_name in local.service_ref_zone_map_check : service_ref => service_ref_name if !contains(keys(service_ref_name), "zone_id") }
136134

137135
cbr_zones = merge(module.cbr_zone, var.existing_serviceref_zone)
138136

@@ -338,7 +336,7 @@ locals {
338336
module "cbr_rule" {
339337
for_each = local.target_service_details
340338
source = "../../modules/cbr-rule-module"
341-
rule_description = "${var.prefix}-${each.key}-rule"
339+
rule_description = try(each.value.description, null) != null ? each.value.description : "${var.prefix}-${each.key}-rule"
342340
enforcement_mode = each.value.enforcement_mode
343341
rule_contexts = lookup(local.allow_rules_by_service, each.key, [])
344342
operations = (length(lookup(local.operations_apitype_val, each.key, [])) > 0) ? [{

‎modules/fscloud/variables.tf‎

Lines changed: 58 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -63,11 +63,64 @@ variable "allow_is_to_cos" {
6363
}
6464

6565
variable "zone_service_ref_list" {
66-
type = list(string)
66+
type = object({
67+
cloud-object-storage = optional(string)
68+
codeengine = optional(string)
69+
containers-kubernetes = optional(string)
70+
databases-for-cassandra = optional(string)
71+
databases-for-elasticsearch = optional(string)
72+
databases-for-enterprisedb = optional(string)
73+
databases-for-etcd = optional(string)
74+
databases-for-mongodb = optional(string)
75+
databases-for-mysql = optional(string)
76+
databases-for-postgresql = optional(string)
77+
databases-for-redis = optional(string)
78+
directlink = optional(string)
79+
iam-groups = optional(string)
80+
is = optional(string)
81+
messagehub = optional(string)
82+
messages-for-rabbitmq = optional(string)
83+
schematics = optional(string)
84+
secrets-manager = optional(string)
85+
server-protect = optional(string)
86+
user-management = optional(string)
87+
apprapp = optional(string)
88+
compliance = optional(string)
89+
event-notifications = optional(string)
90+
logdna = optional(string)
91+
logdnaat = optional(string)
92+
})
93+
default = {
94+
cloud-object-storage = null
95+
codeengine = null
96+
containers-kubernetes = null
97+
databases-for-cassandra = null
98+
databases-for-elasticsearch = null
99+
databases-for-enterprisedb = null
100+
databases-for-etcd = null
101+
databases-for-mongodb = null
102+
databases-for-mysql = null
103+
databases-for-postgresql = null
104+
databases-for-redis = null
105+
directlink = null
106+
iam-groups = null
107+
is = null
108+
messagehub = null
109+
messages-for-rabbitmq = null
110+
schematics = null
111+
secrets-manager = null
112+
server-protect = null
113+
user-management = null
114+
apprapp = null
115+
compliance = null
116+
event-notifications = null
117+
logdna = null
118+
logdnaat = null
119+
}
67120
validation {
68121
condition = alltrue([
69-
for service_ref in var.zone_service_ref_list :
70-
contains(["cloud-object-storage", "codeengine", "containers-kubernetes",
122+
for service_ref, service_ref_name in var.zone_service_ref_list : contains([
123+
"cloud-object-storage", "codeengine", "containers-kubernetes",
71124
"databases-for-cassandra", "databases-for-elasticsearch", "databases-for-enterprisedb",
72125
"databases-for-etcd", "databases-for-mongodb",
73126
"databases-for-mysql", "databases-for-postgresql",
@@ -79,15 +132,7 @@ variable "zone_service_ref_list" {
79132
])
80133
error_message = "Provide a valid service reference for zone creation"
81134
}
82-
default = ["cloud-object-storage", "codeengine", "containers-kubernetes",
83-
"databases-for-cassandra", "databases-for-elasticsearch", "databases-for-enterprisedb",
84-
"databases-for-etcd", "databases-for-mongodb",
85-
"databases-for-mysql", "databases-for-postgresql",
86-
"databases-for-redis", "directlink",
87-
"iam-groups", "is", "messagehub",
88-
"messages-for-rabbitmq", "schematics", "secrets-manager", "server-protect", "user-management",
89-
"apprapp", "compliance", "event-notifications", "logdna", "logdnaat"]
90-
description = "(List) Service reference for the zone creation"
135+
description = "(Optional) Customized name of the zone for the service reference. If not provided, default zone name with the prefix will be created."
91136
}
92137

93138
variable "custom_rule_contexts_by_service" {
@@ -133,6 +178,7 @@ variable "custom_rule_contexts_by_service" {
133178
}
134179
variable "target_service_details" {
135180
type = map(object({
181+
description = optional(string)
136182
target_rg = optional(string)
137183
instance_id = optional(string)
138184
enforcement_mode = string

0 commit comments

Comments
 (0)