Skip to content

Commit 3cae9cd

Browse files
authored
feat: initial release
2 parents aa31b42 + 75a7929 commit 3cae9cd

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

43 files changed

+1472
-315
lines changed

README.md

Lines changed: 63 additions & 109 deletions
Original file line numberDiff line numberDiff line change
@@ -1,88 +1,16 @@
11
<!-- BEGIN MODULE HOOK -->
22

33
<!-- Update the title to match the module name and add a description -->
4-
# Terraform Modules Template Project
5-
<!-- UPDATE BADGE: Update the link for the following badge-->
6-
[![Incubating (Not yet consumable)](https://img.shields.io/badge/status-Incubating%20(Not%20yet%20consumable)-red)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
7-
[![Build status](https://github.com/terraform-ibm-modules/terraform-ibm-module-template/actions/workflows/ci.yml/badge.svg)](https://github.com/terraform-ibm-modules/terraform-ibm-module-template/actions/workflows/ci.yml)
4+
# Context Based Restrications Module
5+
6+
[![Stable (With quality checks)](https://img.shields.io/badge/Status-Stable%20(With%20quality%20checks)-green?style=plastic)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
7+
[![Build Status](https://github.com/terraform-ibm-modules/terraform-ibm-cos/actions/workflows/ci.yml/badge.svg)](https://github.com/terraform-ibm-modules/terraform-ibm-cbr/actions/workflows/ci.yml)
8+
[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
89
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
9-
[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-module-template?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-module-template/releases/latest)
10+
[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-cbr?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-cbr/releases/latest)
1011
[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)
11-
[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
12-
13-
<!-- Remove the content in this H2 heading after completing the steps -->
14-
15-
## Submit a new module
16-
17-
:+1::tada: Thank you for taking the time to contribute! :tada::+1:
18-
19-
This template repository exists to help you create Terraform modules for IBM Cloud.
20-
21-
The default structure includes the following files:
22-
23-
- `README.md`: A description of the module
24-
- `main.tf`: The logic for the module
25-
- `version.tf`: The required terraform and provider versions
26-
- `variables.tf`: The input variables for the module
27-
- `outputs.tf`: The values that are output from the module
28-
For more information, see [Module structure](https://terraform-ibm-modules.github.io/documentation/#/module-structure) in the project documentation.
29-
30-
You can add other content to support what your module does and how it works. For example, you might add a `scripts/` directory that contains shell scripts that are run by a `local-exec` `null_resource` in the Terraform module.
31-
32-
Follow this process to create and submit a Terraform module.
33-
34-
### Create a repo from this repo template
35-
36-
1. Create a repository from this repository template by clicking `Use this template` in the upper right of the GitHub UI.
37-
&emsp;&emsp;&emsp;&emsp;<br>For more information about creating a repository from a template, see the [GitHub docs](https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-a-repository-from-a-template).
38-
1. Select `terraform-ibm-modules` as the owner.
39-
1. Enter a name for the module in format `terraform-ibm-<NAME>`, where `<NAME>` reflects the type of infrastructure that the module manages.
40-
&emsp;&emsp;&emsp;&emsp;<br>Use hyphens as delimiters for names with multiple words (for example, terraform-ibm-`activity-tracker`).
41-
1. Provide a short description of the module.
42-
&emsp;&emsp;&emsp;&emsp;<br>The description is displayed under the repository name on the [organization page](https://github.com/terraform-ibm-modules) and in the **About** section of the repository. Use the description to help users understand the purpose of your module. For more information, see [module names and descriptions](https://terraform-ibm-modules.github.io/documentation/#/implementation-guidelines?id=module-names-and-descriptions) in the docs.
43-
44-
### Clone the repo and set up your development environment
45-
46-
Locally clone the new repository and set up your development environment by completing the tasks in [Local development setup](https://terraform-ibm-modules.github.io/documentation/#/local-dev-setup) in the project documentation.
47-
48-
### Update the repo name and description in source control
49-
50-
To help make sure that the repo name and description are not changed except through pull requests, they are defined in the `settings.yml` file.
51-
52-
Check to make sure that values are uncommented and correct:
53-
54-
1. Open the [settings.yml](.github/settings.yml) file.
55-
1. If not already updated, uncomment the `name` and `description` properties and set the values to what you specified when you requested the repo.
56-
57-
### Update the Terraform files
58-
59-
Implement the logic for your module by updating the `main.tf`, `version.tf`, `variables.tf`, and `outputs.tf` Terraform files. For more information, see [Creating Terraform on IBM Cloud templates](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-create-tf-config).
6012

61-
### Create examples and tests
62-
63-
Add one or more examples in the `examples` directory that consume your new module, and configure tests for them in the `tests` directory. For more information about tests, see [Tests](https://terraform-ibm-modules.github.io/documentation/#/tests).
64-
65-
### Update the content in the readme file
66-
67-
After you implement the logic for your module and create examples and tests, update this readme file in your repository by following these steps:
68-
69-
1. Update the title heading and add a description about your module.
70-
1. Update the badge links.
71-
1. Remove all the content in this H2 heading section.
72-
1. Complete the [Usage](#usage) and [Required IAM access policies](#required-iam-access-policies) sections. The [Examples](#examples) and [Requirements](#requirements) section are populated by a pre-commit hook.
73-
74-
### Commit your code and submit your module for review
75-
76-
1. Before you commit any code, review [Contributing to the IBM Cloud Terraform modules project](https://terraform-ibm-modules.github.io/documentation/#/contribute-module) in the project documentation.
77-
1. Create a pull request for review.
78-
79-
### Post-merge steps
80-
81-
After the first PR for your module is merged, follow these post-merge steps:
82-
83-
1. Create a PR to enable the upgrade test by removing the `t.Skip` line in `tests/pr_test.go`.
84-
85-
<!-- Remove the content in this previous H2 heading -->
13+
This module can be used to provision and configure [Context Based Restrictions](https://cloud.ibm.com/docs/account?topic=account-context-restrictions-create&interface=ui).
8614

8715
## Usage
8816

@@ -94,67 +22,93 @@ unless real values don't help users know what to change.
9422
-->
9523

9624
```hcl
97-
25+
module "ibm_cbr" "zone" {
26+
# replace main with version
27+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-cbr//cbr-zone-module?ref=main"
28+
name = "zone_for_pg_access"
29+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
30+
zone_description = "Zone created from terraform"
31+
addresses = [{type = "vpc",value = "vpc_crn"}]
32+
}
33+
34+
module "ibm_cbr" "rule" {
35+
# replace main with version
36+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-cbr//cbr-rule-module?ref=main"
37+
name = "rule_for_pg_access"
38+
rule_description = "rule from terraform"
39+
enforcement_mode = "enabled"
40+
rule_contexts = var.rule_contexts
41+
resources = var.pg_resource
42+
operations = []
43+
}
9844
```
45+
<!--
46+
Include the following 'Controls' section if the module implements NIST controls
47+
Remove the 'section if the module does not implement controls
48+
-->
9949

100-
## Required IAM access policies
10150

102-
<!-- PERMISSIONS REQUIRED TO RUN MODULE
103-
If this module requires permissions, uncomment the following block and update
104-
the sample permissions, following the format.
105-
Replace the sample Account and IBM Cloud service names and roles with the
106-
information in the console at
107-
Manage > Access (IAM) > Access groups > Access policies.
108-
-->
51+
## Required IAM access policies
10952

110-
<!--
11153
You need the following permissions to run this module.
11254

11355
- Account Management
114-
- **Sample Account Service** service
115-
- `Editor` platform access
116-
- `Manager` service access
117-
- IAM Services
118-
- **Sample Cloud Service** service
119-
- `Administrator` platform access
120-
-->
121-
122-
<!-- NO PERMISSIONS FOR MODULE
123-
If no permissions are required for the module, uncomment the following
124-
statement instead the previous block.
125-
-->
56+
- `Editor` role access
57+
- VPC Infrastructure Services
58+
- `Editor` role access
12659

127-
<!-- No permissions are needed to run this module.-->
12860
<!-- END MODULE HOOK -->
12961
<!-- BEGIN EXAMPLES HOOK -->
13062
## Examples
13163

132-
- [ Default example](examples/default)
133-
- [ Example that uses existing resources](examples/existing-resources)
134-
- [ Non default example](examples/non-default)
64+
- [ Multi zone example](examples/multizone-rule)
65+
- [ Zone example](examples/zone)
13566
<!-- END EXAMPLES HOOK -->
13667
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
13768
## Requirements
13869

13970
| Name | Version |
14071
|------|---------|
14172
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 |
73+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.49.0 |
14274

14375
## Modules
14476

145-
No modules.
77+
| Name | Source | Version |
78+
|------|--------|---------|
79+
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | ./cbr-rule-module | n/a |
80+
| <a name="module_cbr_zone"></a> [cbr\_zone](#module\_cbr\_zone) | ./cbr-zone-module | n/a |
14681

14782
## Resources
14883

149-
No resources.
84+
| Name | Type |
85+
|------|------|
86+
| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/iam_account_settings) | data source |
15087

15188
## Inputs
15289

153-
No inputs.
90+
| Name | Description | Type | Default | Required |
91+
|------|-------------|------|---------|:--------:|
92+
| <a name="input_addresses"></a> [addresses](#input\_addresses) | (List) The list of addresses in the zone | <pre>list(object({<br> type = optional(string)<br> value = optional(string)<br> ref = optional(object({<br> account_id = string<br> location = optional(string)<br> service_instance = optional(string)<br> service_name = optional(string)<br> service_type = optional(string)<br> }))<br> }))</pre> | `[]` | no |
93+
| <a name="input_enforcement_mode"></a> [enforcement\_mode](#input\_enforcement\_mode) | (String) The rule enforcement mode | `string` | `"report"` | no |
94+
| <a name="input_excluded_addresses"></a> [excluded\_addresses](#input\_excluded\_addresses) | (Optional, List) The list of excluded addresses in the zone | <pre>list(object({<br> type = optional(string)<br> value = optional(string)<br> }))</pre> | `[]` | no |
95+
| <a name="input_name"></a> [name](#input\_name) | (Optional, String) The name of the zone | `string` | `null` | no |
96+
| <a name="input_operations"></a> [operations](#input\_operations) | (Optional, List) The operations this rule applies to | <pre>list(object({<br> api_types = list(object({<br> api_type_id = string<br> }))<br> }))</pre> | `[]` | no |
97+
| <a name="input_resources"></a> [resources](#input\_resources) | (Optional, List) The resources this rule apply to | <pre>list(object({<br> attributes = list(object({<br> name = string<br> value = string<br> operator = optional(string)<br> }))<br> tags = optional(list(object({<br> name = string<br> value = string<br> operator = optional(string)<br> })))<br> }))</pre> | `[]` | no |
98+
| <a name="input_rule_contexts"></a> [rule\_contexts](#input\_rule\_contexts) | (List) The contexts the rule applies to | <pre>list(object({<br> attributes = list(object({<br> name = string<br> value = string<br> }))<br> }))</pre> | <pre>[<br> {<br> "attributes": [<br> {<br> "name": "va",<br> "value": "va"<br> }<br> ]<br> }<br>]</pre> | no |
99+
| <a name="input_rule_description"></a> [rule\_description](#input\_rule\_description) | (Optional, String) The description of the rule | `string` | `null` | no |
100+
| <a name="input_zone_description"></a> [zone\_description](#input\_zone\_description) | (Optional, String) The description of the zone | `string` | `null` | no |
154101

155102
## Outputs
156103

157-
No outputs.
104+
| Name | Description |
105+
|------|-------------|
106+
| <a name="output_rule_crn"></a> [rule\_crn](#output\_rule\_crn) | CBR rule resource instance crn |
107+
| <a name="output_rule_href"></a> [rule\_href](#output\_rule\_href) | CBR rule resource href |
108+
| <a name="output_rule_id"></a> [rule\_id](#output\_rule\_id) | CBR rule resource instance id |
109+
| <a name="output_zone_crn"></a> [zone\_crn](#output\_zone\_crn) | cbr\_zone resource instance crn |
110+
| <a name="output_zone_href"></a> [zone\_href](#output\_zone\_href) | cbr\_zone resource instance link |
111+
| <a name="output_zone_id"></a> [zone\_id](#output\_zone\_id) | cbr\_zone resource instance id |
158112
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
159113
<!-- BEGIN CONTRIBUTING HOOK -->
160114

cbr-rule-module/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# CBR Rule Module
2+
3+
Creates a rule for Context Based Restrictions

cbr-rule-module/main.tf

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
##############################################################################
2+
# Context Based Restrictions module
3+
#
4+
# Creates CBR Rule
5+
##############################################################################
6+
7+
locals {
8+
operations = var.operations == null && length(var.operations) == 0 ? null : var.operations
9+
resources = var.resources == null && length(var.resources) == 0 ? null : var.resources
10+
contexts = var.rule_contexts == null && length(var.rule_contexts) == 0 ? null : var.rule_contexts
11+
}
12+
13+
resource "ibm_cbr_rule" "cbr_rule" {
14+
description = var.rule_description
15+
enforcement_mode = var.enforcement_mode
16+
17+
dynamic "contexts" {
18+
for_each = local.contexts
19+
content {
20+
dynamic "attributes" {
21+
for_each = local.contexts[0].attributes == null ? [] : local.contexts[0].attributes
22+
iterator = attribute
23+
content {
24+
name = attribute.value.name
25+
value = attribute.value.value
26+
}
27+
}
28+
}
29+
}
30+
31+
dynamic "resources" {
32+
for_each = local.resources
33+
content {
34+
dynamic "attributes" {
35+
for_each = local.resources[0].attributes == null ? [] : local.resources[0].attributes
36+
iterator = attribute
37+
content {
38+
name = attribute.value.name
39+
value = attribute.value.value
40+
operator = attribute.value.operator
41+
}
42+
}
43+
dynamic "tags" {
44+
for_each = local.resources[0].tags == null ? [] : local.resources[0].tags
45+
iterator = tag
46+
content {
47+
name = tag.value.name
48+
value = tag.value.value
49+
}
50+
}
51+
}
52+
}
53+
54+
dynamic "operations" {
55+
for_each = local.operations
56+
content {
57+
dynamic "api_types" {
58+
for_each = var.operations[0].api_types == null ? null : var.operations[0].api_types
59+
iterator = apitype
60+
content {
61+
api_type_id = apitype.value["api_type_id"]
62+
}
63+
}
64+
}
65+
}
66+
}

cbr-rule-module/outputs.tf

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "rule_id" {
6+
value = join("", ibm_cbr_rule.cbr_rule[*].id)
7+
description = "CBR rule resource instance id"
8+
}
9+
10+
output "rule_crn" {
11+
value = join("", ibm_cbr_rule.cbr_rule[*].crn)
12+
description = "CBR rule resource instance crn"
13+
}
14+
15+
output "rule_href" {
16+
value = join("", ibm_cbr_rule.cbr_rule[*].href)
17+
description = "CBR rule resource href"
18+
}

cbr-rule-module/variables.tf

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
##############################################################################
2+
# Rule Related Input Variables
3+
##############################################################################
4+
5+
variable "rule_description" {
6+
type = string
7+
description = "(Optional, String) The description of the rule"
8+
default = null
9+
validation {
10+
condition = anytrue([
11+
var.rule_description == null,
12+
alltrue([
13+
can(length(var.rule_description) >= 0),
14+
can(length(var.rule_description) <= 300),
15+
can(regex("^[\\x20-\\xFE]+$", var.rule_description))
16+
])
17+
])
18+
error_message = "Value should be a valid rule description with 1-300 characters"
19+
}
20+
21+
}
22+
23+
variable "rule_contexts" {
24+
type = list(object({
25+
attributes = optional(list(object({
26+
name = string
27+
value = string
28+
})))
29+
}))
30+
description = "(List) The contexts the rule applies to"
31+
default = []
32+
validation {
33+
condition = anytrue(
34+
flatten(
35+
[for rule_context in var.rule_contexts :
36+
[for attribute in rule_context.attributes : alltrue([
37+
length(attribute.name) >= 2,
38+
length(attribute.name) <= 128,
39+
can(regex("^[a-zA-Z0-9]+$", attribute.name))
40+
])]
41+
]
42+
)
43+
)
44+
error_message = "Value should be a valid rule context name"
45+
}
46+
}
47+
48+
variable "enforcement_mode" {
49+
type = string
50+
description = "(String) The rule enforcement mode"
51+
default = "report" # As part of the best practices, mode should be in report only mode for 30 days before the rules is enabled.
52+
validation {
53+
condition = anytrue([
54+
var.enforcement_mode == "enabled",
55+
var.enforcement_mode == "disabled",
56+
var.enforcement_mode == "report"
57+
])
58+
error_message = "Valid values for enforcement mode can be 'enabled', 'disabled' and 'report'"
59+
}
60+
}
61+
62+
variable "resources" {
63+
type = list(object({
64+
attributes = optional(list(object({
65+
name = string
66+
value = string
67+
operator = optional(string)
68+
})))
69+
tags = optional(list(object({
70+
name = string
71+
value = string
72+
operator = optional(string)
73+
})))
74+
}))
75+
description = "(Optional, List) The resources this rule apply to"
76+
default = []
77+
78+
}
79+
80+
variable "operations" {
81+
type = list(object({
82+
api_types = list(object({
83+
api_type_id = string
84+
}))
85+
}))
86+
description = "(Optional, List) The operations this rule applies to"
87+
}

0 commit comments

Comments
 (0)