|
| 1 | +############################################################################## |
| 2 | +# Resource Group |
| 3 | +############################################################################## |
| 4 | + |
| 5 | +module "resource_group" { |
| 6 | + source = "terraform-ibm-modules/resource-group/ibm" |
| 7 | + version = "1.0.5" |
| 8 | + # if an existing resource group is not set (null) create a new one using prefix |
| 9 | + resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null |
| 10 | + existing_resource_group_name = var.resource_group |
| 11 | +} |
| 12 | + |
| 13 | +# ############################################################################## |
| 14 | +# # Get Cloud Account ID |
| 15 | +# ############################################################################## |
| 16 | +data "ibm_iam_account_settings" "iam_account_settings" { |
| 17 | +} |
| 18 | + |
| 19 | +############################################################################## |
| 20 | +# VPC |
| 21 | +############################################################################## |
| 22 | +resource "ibm_is_vpc" "example_vpc" { |
| 23 | + name = "${var.prefix}-vpc" |
| 24 | + resource_group = module.resource_group.resource_group_id |
| 25 | + tags = var.resource_tags |
| 26 | +} |
| 27 | + |
| 28 | +resource "ibm_is_public_gateway" "testacc_gateway" { |
| 29 | + name = "${var.prefix}-pgateway" |
| 30 | + vpc = ibm_is_vpc.example_vpc.id |
| 31 | + zone = "${var.region}-1" |
| 32 | + resource_group = module.resource_group.resource_group_id |
| 33 | +} |
| 34 | + |
| 35 | +resource "ibm_is_subnet" "testacc_subnet" { |
| 36 | + name = "${var.prefix}-subnet" |
| 37 | + vpc = ibm_is_vpc.example_vpc.id |
| 38 | + zone = "${var.region}-1" |
| 39 | + public_gateway = ibm_is_public_gateway.testacc_gateway.id |
| 40 | + total_ipv4_address_count = 256 |
| 41 | + resource_group = module.resource_group.resource_group_id |
| 42 | +} |
| 43 | + |
| 44 | +############################################################################## |
| 45 | +# CBR zone & rule creation |
| 46 | +############################################################################## |
| 47 | + |
| 48 | +module "cbr_account_level" { |
| 49 | + source = "../../profiles/fscloud" |
| 50 | + prefix = var.prefix |
| 51 | + zone_vpc_crn_list = [ibm_is_vpc.example_vpc.crn] |
| 52 | + allow_cos_to_kms = var.allow_cos_to_kms |
| 53 | + allow_block_storage_to_kms = var.allow_block_storage_to_kms |
| 54 | + allow_roks_to_kms = var.allow_roks_to_kms |
| 55 | + allow_vpcs_to_container_registry = var.allow_vpcs_to_container_registry |
| 56 | + allow_vpcs_to_cos = var.allow_vpcs_to_cos |
| 57 | + |
| 58 | + ## Enable enforcement for key protect as an example |
| 59 | + ## The other services not referenced here, are either report, or disabled (when not support report) |
| 60 | + target_service_details = { |
| 61 | + "kms" = { |
| 62 | + "enforcement_mode" = "enabled" |
| 63 | + } |
| 64 | + } |
| 65 | + |
| 66 | + # Demonstrates how additional context to the rules created by this module can be added. |
| 67 | + # This example open up: |
| 68 | + # 1. Flows from icd mongodb, postgresql to kms on private endpoint |
| 69 | + # 2. Flow from schematics on public kms endpoint |
| 70 | + # 3. Add a block of ips to schematics public endpoint |
| 71 | + # 4. Flow from vpc(s) specified in input zone_vpc_crn_list to postgresql private endpoint |
| 72 | + custom_rule_contexts_by_service = { |
| 73 | + "kms" = [{ |
| 74 | + endpointType = "private" |
| 75 | + service_ref_names = ["databases-for-mongodb", "databases-for-postgresql"] |
| 76 | + }, |
| 77 | + { |
| 78 | + endpointType = "public" |
| 79 | + service_ref_names = ["schematics"] |
| 80 | + } |
| 81 | + ], |
| 82 | + "schematics" = [{ |
| 83 | + endpointType = "public" |
| 84 | + zone_ids = [module.cbr_zone_operator_ips.zone_id] |
| 85 | + }], |
| 86 | + "databases-for-postgresql" = [{ |
| 87 | + endpointType = "private" |
| 88 | + ## Give access to the zone containing the VPC passed in zone_vpc_crn_list input |
| 89 | + add_managed_vpc_zone = true |
| 90 | + }] |
| 91 | + } |
| 92 | +} |
| 93 | + |
| 94 | +## Example of zone using ip addresses, and reference in one of the zone created by the cbr_account_level above. |
| 95 | +## A zone used to group operator machine ips. |
| 96 | +module "cbr_zone_operator_ips" { |
| 97 | + source = "../../cbr-zone-module" |
| 98 | + name = "List of operator environment public IPs" |
| 99 | + account_id = data.ibm_iam_account_settings.iam_account_settings.account_id |
| 100 | + zone_description = "Zone grouping list of known public ips for operator machines" |
| 101 | + addresses = [{ |
| 102 | + type = "subnet" |
| 103 | + value = "0.0.0.0/0" # All ip for this public example - this would be narrowed down typically to an enterprise ip block |
| 104 | + }] |
| 105 | +} |
| 106 | + |
| 107 | +## Examples of data lookup on objects (zone, rule) created by the fscoud profile module |
| 108 | +## Get rule targetting "event-notification" |
| 109 | +data "ibm_cbr_rule" "event_notification_rule" { |
| 110 | + rule_id = module.cbr_account_level.map_target_service_rule_ids["event-notifications"].rule_id |
| 111 | +} |
| 112 | + |
| 113 | +## Get zone having "event-notification" as single source |
| 114 | +data "ibm_cbr_zone" "event_notifications_zone" { |
| 115 | + zone_id = module.cbr_account_level.map_service_ref_name_zoneid["event-notifications"].zone_id |
| 116 | +} |
0 commit comments