Skip to content

Commit 75bc0e1

Browse files
Ak-skyAk-sky
authored
doc: expand documentation around the cbr-service-profile (#268)
1 parent 2be6082 commit 75bc0e1

File tree

30 files changed

+130
-63
lines changed

30 files changed

+130
-63
lines changed

‎README.md‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,24 @@ This module can be used to provision and configure [Context Based Restrictions](
1313

1414
See in particular the [fscloud profile](./profiles/fscloud/) module that enables creating an opiniated account-level coarse-grained set of CBR rules and zones aligned with the "secure by default" principles.
1515

16+
<!-- BEGIN OVERVIEW HOOK -->
17+
## Overview
18+
* [terraform-ibm-cbr](#terraform-ibm-cbr)
19+
* [Submodules](./modules)
20+
* [cbr-rule-module](./modules/cbr-rule-module)
21+
* [cbr-service-profile](./modules/cbr-service-profile)
22+
* [cbr-zone-module](./modules/cbr-zone-module)
23+
* [fscloud](./modules/fscloud)
24+
* [Examples](./examples)
25+
* [CBR multi service profile](./examples/multi-service-profile)
26+
* [Multi-zone example](./examples/multizone-rule)
27+
* [Pre-wired CBR configuration for FS Cloud example](./examples/fscloud)
28+
* [Zone example](./examples/zone)
29+
* [Contributing](#contributing)
30+
31+
## terraform-ibm-cbr
32+
<!-- END OVERVIEW HOOK -->
33+
1634
## Usage
1735

1836
```hcl
@@ -58,10 +76,11 @@ You need the following permissions to run this module.
5876
## Examples
5977

6078
- [ Pre-wired CBR configuration for FS Cloud example](examples/fscloud)
61-
- [ CBR Multi Service Profile](examples/multi-service-profile)
79+
- [ CBR multi service profile](examples/multi-service-profile)
6280
- [ Multi-zone example](examples/multizone-rule)
6381
- [ Zone example](examples/zone)
6482
<!-- END EXAMPLES HOOK -->
83+
6584
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
6685
### Requirements
6786

@@ -74,8 +93,8 @@ You need the following permissions to run this module.
7493

7594
| Name | Source | Version |
7695
|------|--------|---------|
77-
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | ./cbr-rule-module | n/a |
78-
| <a name="module_cbr_zone"></a> [cbr\_zone](#module\_cbr\_zone) | ./cbr-zone-module | n/a |
96+
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | ./modules/cbr-rule-module | n/a |
97+
| <a name="module_cbr_zone"></a> [cbr\_zone](#module\_cbr\_zone) | ./modules/cbr-zone-module | n/a |
7998

8099
### Resources
81100

‎cbr-service-profile/README.md‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,47 @@
1-
# CBR Rule Profile
2-
3-
Accepts a list of VPC crns / service references to create CBR zones and a list of target services, to create the rule matching these profiles. It supports to target the service using name, account id, tags, resource group.
1+
# CBR service module
2+
3+
This module creates a list of CBR zones and rules. Accepts a list of VPC CRNs / service references to create CBR zones and a list of target services to create the rule matching these profiles. It supports to target the service using name, account id, tags, resource group.
4+
## Usage
5+
6+
```hcl
7+
locals {
8+
zone_vpc_crn_list = [ibm_is_vpc.example_vpc.crn]
9+
enforcement_mode = "report"
10+
# Merge zone ids to pass as contexts to the rule
11+
target_services_details = [
12+
{
13+
target_service_name = "kms",
14+
target_rg = module.resource_group.resource_group_id
15+
enforcement_mode = local.enforcement_mode
16+
}
17+
]
18+
}
19+
module "cbr_rule_multi_service_profile" {
20+
source = "../../cbr-service-profile"
21+
zone_service_ref_list = ["cloud-object-storage", "containers-kubernetes", "server-protect"]
22+
zone_vpc_crn_list = local.zone_vpc_crn_list
23+
target_service_details = local.target_services_details
24+
}
25+
```
426

527
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
628
### Requirements
729

8-
| Name | Version |
9-
|------|---------|
10-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
11-
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.49.0 |
30+
No requirements.
1231

1332
### Modules
1433

15-
| Name | Source | Version |
16-
|------|--------|---------|
17-
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | ../cbr-rule-module | n/a |
18-
| <a name="module_cbr_zone"></a> [cbr\_zone](#module\_cbr\_zone) | ../cbr-zone-module | n/a |
34+
No modules.
1935

2036
### Resources
2137

22-
| Name | Type |
23-
|------|------|
24-
| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/iam_account_settings) | data source |
38+
No resources.
2539

2640
### Inputs
2741

28-
| Name | Description | Type | Default | Required |
29-
|------|-------------|------|---------|:--------:|
30-
| <a name="input_endpoints"></a> [endpoints](#input\_endpoints) | List specific endpoint types for target services, valid values for endpoints are 'public', 'private' or 'direct' | `list(string)` | <pre>[<br> "private"<br>]</pre> | no |
31-
| <a name="input_location"></a> [location](#input\_location) | The region in which the network zone is scoped | `string` | `"us-south"` | no |
32-
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix to append to all vpc\_zone\_list, service\_ref\_zone\_list and cbr\_rule\_description created by this submodule | `string` | `"serviceprofile"` | no |
33-
| <a name="input_target_service_details"></a> [target\_service\_details](#input\_target\_service\_details) | (String) Details of the target service for which the rule has to be created | <pre>list(object({<br> target_service_name = string<br> target_rg = optional(string)<br> enforcement_mode = string<br> tags = optional(list(string))<br> }))</pre> | n/a | yes |
34-
| <a name="input_zone_service_ref_list"></a> [zone\_service\_ref\_list](#input\_zone\_service\_ref\_list) | (List) Service reference for the zone creation | `list(string)` | `[]` | no |
35-
| <a name="input_zone_vpc_crn_list"></a> [zone\_vpc\_crn\_list](#input\_zone\_vpc\_crn\_list) | (List) VPC CRN for the zones | `list(string)` | `[]` | no |
42+
No inputs.
3643

3744
### Outputs
3845

39-
| Name | Description |
40-
|------|-------------|
41-
| <a name="output_rule_crns"></a> [rule\_crns](#output\_rule\_crns) | CBR rule crn(s) |
42-
| <a name="output_rule_hrefs"></a> [rule\_hrefs](#output\_rule\_hrefs) | CBR rule href(s) |
43-
| <a name="output_rule_ids"></a> [rule\_ids](#output\_rule\_ids) | CBR rule id(s) |
44-
| <a name="output_zone_crns"></a> [zone\_crns](#output\_zone\_crns) | CBR zone crn(s) |
45-
| <a name="output_zone_hrefs"></a> [zone\_hrefs](#output\_zone\_hrefs) | CBR zone href(s) |
46-
| <a name="output_zone_ids"></a> [zone\_ids](#output\_zone\_ids) | CBR zone resource instance id(s) |
46+
No outputs.
4747
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎examples/fscloud/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ resource "ibm_is_subnet" "testacc_subnet" {
4646
##############################################################################
4747

4848
module "cbr_account_level" {
49-
source = "../../profiles/fscloud"
49+
source = "../../modules/fscloud"
5050
prefix = var.prefix
5151
zone_vpc_crn_list = [ibm_is_vpc.example_vpc.crn]
5252
allow_cos_to_kms = var.allow_cos_to_kms
@@ -94,7 +94,7 @@ module "cbr_account_level" {
9494
## Example of zone using ip addresses, and reference in one of the zone created by the cbr_account_level above.
9595
## A zone used to group operator machine ips.
9696
module "cbr_zone_operator_ips" {
97-
source = "../../cbr-zone-module"
97+
source = "../../modules/cbr-zone-module"
9898
name = "List of operator environment public IPs"
9999
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
100100
zone_description = "Zone grouping list of known public ips for operator machines"

‎examples/multi-service-profile/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# CBR Multi Service Profile
1+
# CBR multi service profile
22

33
An end-to-end example that uses the submodule cbr-service-profile. This example uses the IBM Cloud Provider to automate the following infrastructure::
44

‎examples/multi-service-profile/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ locals {
6060

6161
module "cbr_rule_multi_service_profile" {
6262
prefix = var.prefix
63-
source = "../../cbr-service-profile"
63+
source = "../../modules/cbr-service-profile"
6464
zone_service_ref_list = var.zone_service_ref_list
6565
zone_vpc_crn_list = local.zone_vpc_crn_list
6666
target_service_details = local.target_services_details

‎examples/multizone-rule/main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,7 +65,7 @@ locals {
6565

6666
module "cbr_zone" {
6767
count = length(local.zone_list)
68-
source = "../../cbr-zone-module"
68+
source = "../../modules/cbr-zone-module"
6969
name = local.zone_list[count.index].name
7070
zone_description = local.zone_list[count.index].zone_description
7171
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
@@ -139,7 +139,7 @@ resource "ibm_resource_tag" "attach_tags" {
139139
}
140140

141141
module "cbr_rule" {
142-
source = "../../cbr-rule-module"
142+
source = "../../modules/cbr-rule-module"
143143
rule_description = "${var.prefix} ${var.rule_description}"
144144
enforcement_mode = var.enforcement_mode
145145
rule_contexts = local.rule_contexts

‎examples/zone/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ locals {
6060
}
6161

6262
module "ibm_cbr_zone" {
63-
source = "../../cbr-zone-module"
63+
source = "../../modules/cbr-zone-module"
6464
name = "${var.prefix}-cbr-zone"
6565
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
6666
zone_description = var.zone_description

‎main.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ data "ibm_iam_account_settings" "iam_account_settings" {
1111
##############################################################################
1212

1313
module "cbr_zone" {
14-
source = "./cbr-zone-module"
14+
source = "./modules/cbr-zone-module"
1515
name = var.name
1616
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
1717
zone_description = var.zone_description
@@ -20,7 +20,7 @@ module "cbr_zone" {
2020
}
2121

2222
module "cbr_rule" {
23-
source = "./cbr-rule-module"
23+
source = "./modules/cbr-rule-module"
2424
rule_description = var.rule_description
2525
enforcement_mode = var.enforcement_mode
2626
rule_contexts = var.rule_contexts

‎module-metadata.json‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -213,7 +213,7 @@
213213
"module_calls": {
214214
"cbr_rule": {
215215
"name": "cbr_rule",
216-
"source": "./cbr-rule-module",
216+
"source": "./modules/cbr-rule-module",
217217
"attributes": {
218218
"enforcement_mode": "enforcement_mode",
219219
"operations": "operations",
@@ -234,7 +234,7 @@
234234
"name": "ibm"
235235
},
236236
"pos": {
237-
"filename": "cbr-rule-module/main.tf",
237+
"filename": "modules/cbr-rule-module/main.tf",
238238
"line": 7
239239
}
240240
}
@@ -246,7 +246,7 @@
246246
"description": "CBR rule resource instance crn",
247247
"value": "ibm_cbr_rule.cbr_rule.crn",
248248
"pos": {
249-
"filename": "cbr-rule-module/outputs.tf",
249+
"filename": "modules/cbr-rule-module/outputs.tf",
250250
"line": 15
251251
},
252252
"type": "TypeString",
@@ -257,7 +257,7 @@
257257
"description": "CBR rule resource instance description",
258258
"value": "ibm_cbr_rule.cbr_rule.description",
259259
"pos": {
260-
"filename": "cbr-rule-module/outputs.tf",
260+
"filename": "modules/cbr-rule-module/outputs.tf",
261261
"line": 5
262262
},
263263
"type": "TypeString"
@@ -267,7 +267,7 @@
267267
"description": "CBR rule resource href",
268268
"value": "ibm_cbr_rule.cbr_rule.href",
269269
"pos": {
270-
"filename": "cbr-rule-module/outputs.tf",
270+
"filename": "modules/cbr-rule-module/outputs.tf",
271271
"line": 20
272272
},
273273
"type": "TypeString"
@@ -277,7 +277,7 @@
277277
"description": "CBR rule resource instance id",
278278
"value": "ibm_cbr_rule.cbr_rule.id",
279279
"pos": {
280-
"filename": "cbr-rule-module/outputs.tf",
280+
"filename": "modules/cbr-rule-module/outputs.tf",
281281
"line": 10
282282
}
283283
}
@@ -289,7 +289,7 @@
289289
},
290290
"cbr_zone": {
291291
"name": "cbr_zone",
292-
"source": "./cbr-zone-module",
292+
"source": "./modules/cbr-zone-module",
293293
"attributes": {
294294
"addresses": "addresses",
295295
"excluded_addresses": "excluded_addresses",
@@ -310,7 +310,7 @@
310310
"name": "ibm"
311311
},
312312
"pos": {
313-
"filename": "cbr-zone-module/main.tf",
313+
"filename": "modules/cbr-zone-module/main.tf",
314314
"line": 7
315315
}
316316
}
@@ -322,7 +322,7 @@
322322
"description": "CBR zone resource instance crn",
323323
"value": "ibm_cbr_zone.cbr_zone.crn",
324324
"pos": {
325-
"filename": "cbr-zone-module/outputs.tf",
325+
"filename": "modules/cbr-zone-module/outputs.tf",
326326
"line": 20
327327
},
328328
"type": "TypeString",
@@ -333,7 +333,7 @@
333333
"description": "(Optional, String) The description of the zone",
334334
"value": "var.zone_description",
335335
"pos": {
336-
"filename": "cbr-zone-module/outputs.tf",
336+
"filename": "modules/cbr-zone-module/outputs.tf",
337337
"line": 10
338338
},
339339
"type": "string"
@@ -343,7 +343,7 @@
343343
"description": "CBR zone resource instance link",
344344
"value": "ibm_cbr_zone.cbr_zone.href",
345345
"pos": {
346-
"filename": "cbr-zone-module/outputs.tf",
346+
"filename": "modules/cbr-zone-module/outputs.tf",
347347
"line": 25
348348
},
349349
"type": "TypeString"
@@ -353,7 +353,7 @@
353353
"description": "CBR zone resource instance id",
354354
"value": "ibm_cbr_zone.cbr_zone.id",
355355
"pos": {
356-
"filename": "cbr-zone-module/outputs.tf",
356+
"filename": "modules/cbr-zone-module/outputs.tf",
357357
"line": 15
358358
}
359359
},
@@ -362,7 +362,7 @@
362362
"description": "CBR zone resource instance name",
363363
"value": "ibm_cbr_zone.cbr_zone.name",
364364
"pos": {
365-
"filename": "cbr-zone-module/outputs.tf",
365+
"filename": "modules/cbr-zone-module/outputs.tf",
366366
"line": 5
367367
},
368368
"type": "TypeString"

‎cbr-rule-module/README.md‎ renamed to ‎modules/cbr-rule-module/README.md‎

File renamed without changes.

0 commit comments

Comments
 (0)