Skip to content

Commit 11bfd37

Browse files
alex-reiffalex-reiff
authored
test: removed iam engine from examples and tests (#69)
* remove iam engine
1 parent e461382 commit 11bfd37

File tree

3 files changed

+11
-52
lines changed

3 files changed

+11
-52
lines changed

‎examples/all-combined/secretsmanager.tf‎

Lines changed: 3 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,7 @@ locals {
3131
sm_crn = var.existing_sm_instance_crn == null ? (var.service_endpoints == "private" ? ibm_resource_instance.secrets_manager[0].crn : "") : var.existing_sm_instance_crn
3232

3333

34-
sm_region = var.existing_sm_instance_region == null ? var.region : var.existing_sm_instance_region
35-
sm_acct_id = var.existing_sm_instance_guid == null ? module.iam_secrets_engine[0].acct_secret_group_id : module.secrets_manager_group_acct[0].secret_group_id
34+
sm_region = var.existing_sm_instance_region == null ? var.region : var.existing_sm_instance_region
3635
}
3736

3837

@@ -55,24 +54,6 @@ resource "ibm_resource_instance" "secrets_manager" {
5554
provider = ibm.ibm-sm
5655
}
5756

58-
# Configure IAM secrets engine
59-
module "iam_secrets_engine" {
60-
count = var.existing_sm_instance_guid == null ? 1 : 0
61-
source = "terraform-ibm-modules/secrets-manager-iam-engine/ibm"
62-
version = "1.2.11"
63-
region = local.sm_region
64-
secrets_manager_guid = ibm_resource_instance.secrets_manager[0].guid
65-
iam_secret_generator_service_id_name = "${var.prefix}-sid:0.0.1:${ibm_resource_instance.secrets_manager[0].name}-iam-secret-generator:automated:simple-service:secret-manager:"
66-
iam_secret_generator_apikey_name = "${var.prefix}-iam-secret-generator-apikey"
67-
new_secret_group_name = "${var.prefix}-account-secret-group"
68-
iam_secret_generator_apikey_secret_name = "${var.prefix}-iam-secret-generator-apikey-secret"
69-
iam_engine_name = "iam-engine"
70-
endpoint_type = var.service_endpoints
71-
providers = {
72-
ibm = ibm.ibm-sm
73-
}
74-
}
75-
7657
# create secrets group for secrets
7758
module "secrets_manager_group" {
7859
source = "terraform-ibm-modules/secrets-manager-secret-group/ibm"
@@ -90,13 +71,11 @@ module "secrets_manager_group" {
9071
module "secrets_manager_group_acct" {
9172
source = "terraform-ibm-modules/secrets-manager-secret-group/ibm"
9273
version = "1.3.2"
93-
count = var.existing_sm_instance_guid == null ? 0 : 1
9474
region = local.sm_region
9575
secrets_manager_guid = local.sm_guid
9676
#tfsec:ignore:general-secrets-no-plaintext-exposure
9777
secret_group_name = "${var.prefix}-account-secret-group" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value
9878
secret_group_description = "Secret-Group for storing account credentials" #tfsec:ignore:general-secrets-no-plaintext-exposure
99-
depends_on = [module.iam_secrets_engine]
10079
providers = {
10180
ibm = ibm.ibm-sm
10281
}
@@ -135,8 +114,8 @@ module "dynamic_serviceid_apikey1" {
135114
sm_iam_secret_description = "Example of dynamic IAM secret / apikey" #tfsec:ignore:general-secrets-no-plaintext-exposure
136115
serviceid_id = ibm_iam_service_id.secret_puller.id
137116
secrets_manager_guid = local.sm_guid
138-
secret_group_id = local.sm_acct_id
139-
depends_on = [module.iam_secrets_engine, ibm_iam_service_policy.secret_puller_policy, ibm_iam_service_id.secret_puller]
117+
secret_group_id = module.secrets_manager_group_acct.secret_group_id
118+
depends_on = [ibm_iam_service_policy.secret_puller_policy, ibm_iam_service_id.secret_puller]
140119
providers = {
141120
ibm = ibm.ibm-sm
142121
}

‎examples/all-combined/secretstore.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ module "image_pull" {
9898
#tfsec:ignore:general-secrets-no-plaintext-exposure
9999
service_id_secret_name = "${var.prefix}-image-pull-service-id"
100100
service_id_secret_group_id = module.secrets_manager_group.secret_group_id
101-
depends_on = [module.iam_secrets_engine, module.secrets_manager_group]
101+
depends_on = [module.secrets_manager_group]
102102
providers = {
103103
ibm = ibm.ibm-sm
104104
}
@@ -138,7 +138,7 @@ module "image_pull_chain_secret_1" {
138138
#tfsec:ignore:general-secrets-no-plaintext-exposure
139139
service_id_secret_name = "${var.prefix}-image-pull-service-id-chain-sec-1"
140140
service_id_secret_group_id = module.secrets_manager_group.secret_group_id
141-
depends_on = [module.iam_secrets_engine, module.secrets_manager_group]
141+
depends_on = [module.secrets_manager_group]
142142
providers = {
143143
ibm = ibm.ibm-sm
144144
}
@@ -154,7 +154,7 @@ module "image_pull_chain_secret_2" {
154154
#tfsec:ignore:general-secrets-no-plaintext-exposure
155155
service_id_secret_name = "${var.prefix}-image-pull-service-id-chain-sec-2"
156156
service_id_secret_group_id = module.secrets_manager_group.secret_group_id
157-
depends_on = [module.iam_secrets_engine, module.secrets_manager_group]
157+
depends_on = [module.secrets_manager_group]
158158
providers = {
159159
ibm = ibm.ibm-sm
160160
}
@@ -170,7 +170,7 @@ module "image_pull_chain_secret_3" {
170170
#tfsec:ignore:general-secrets-no-plaintext-exposure
171171
service_id_secret_name = "${var.prefix}-image-pull-service-id-chain-sec-3"
172172
service_id_secret_group_id = module.secrets_manager_group.secret_group_id
173-
depends_on = [module.iam_secrets_engine, module.secrets_manager_group]
173+
depends_on = [module.secrets_manager_group]
174174
providers = {
175175
ibm = ibm.ibm-sm
176176
}

‎examples/basic/main.tf‎

Lines changed: 4 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ locals {
1818

1919

2020
sm_region = var.existing_sm_instance_region == null ? var.region : var.existing_sm_instance_region
21-
sm_acct_id = var.existing_sm_instance_guid == null ? module.iam_secrets_engine[0].acct_secret_group_id : module.secrets_manager_group_acct[0].secret_group_id
2221
es_namespace_apikey = "es-operator" # pragma: allowlist secret
2322
eso_namespace = "apikeynspace1"
2423
}
@@ -279,30 +278,11 @@ resource "ibm_resource_instance" "secrets_manager" {
279278
module "secrets_manager_group_acct" {
280279
source = "terraform-ibm-modules/secrets-manager-secret-group/ibm"
281280
version = "1.3.2"
282-
count = var.existing_sm_instance_guid == null ? 0 : 1
283281
region = local.sm_region
284282
secrets_manager_guid = local.sm_guid
285283
#tfsec:ignore:general-secrets-no-plaintext-exposure
286284
secret_group_name = "${var.prefix}-account-secret-group" #checkov:skip=CKV_SECRET_6: does not require high entropy string as is static value
287285
secret_group_description = "Secret-Group for storing account credentials" #tfsec:ignore:general-secrets-no-plaintext-exposure
288-
depends_on = [module.iam_secrets_engine]
289-
providers = {
290-
ibm = ibm.ibm-sm
291-
}
292-
}
293-
294-
# Configure instance with IAM engine
295-
module "iam_secrets_engine" {
296-
count = var.existing_sm_instance_guid == null ? 1 : 0
297-
source = "terraform-ibm-modules/secrets-manager-iam-engine/ibm"
298-
version = "1.2.11"
299-
region = local.sm_region
300-
secrets_manager_guid = ibm_resource_instance.secrets_manager[0].guid
301-
iam_secret_generator_service_id_name = "${var.prefix}-sid:0.0.1:${ibm_resource_instance.secrets_manager[0].name}-iam-secret-generator:automated:simple-service:secret-manager:"
302-
iam_secret_generator_apikey_name = "${var.prefix}-iam-secret-generator-apikey"
303-
new_secret_group_name = "${var.prefix}-account-secret-group"
304-
iam_secret_generator_apikey_secret_name = "${var.prefix}-iam-secret-generator-apikey-secret"
305-
iam_engine_name = "iam-engine"
306286
providers = {
307287
ibm = ibm.ibm-sm
308288
}
@@ -327,7 +307,7 @@ resource "ibm_iam_service_policy" "secret_puller_policy" {
327307
service = "secrets-manager"
328308
resource_instance_id = local.sm_guid
329309
resource_type = "secret-group"
330-
resource = local.sm_acct_id
310+
resource = module.secrets_manager_group_acct.secret_group_id
331311
}
332312
}
333313

@@ -353,8 +333,8 @@ module "dynamic_serviceid_apikey1" {
353333
sm_iam_secret_description = "Example of dynamic IAM secret / apikey" #tfsec:ignore:general-secrets-no-plaintext-exposure
354334
serviceid_id = ibm_iam_service_id.secret_puller.id
355335
secrets_manager_guid = local.sm_guid
356-
secret_group_id = local.sm_acct_id
357-
depends_on = [module.iam_secrets_engine, ibm_iam_service_policy.secret_puller_policy, ibm_iam_service_id.secret_puller]
336+
secret_group_id = module.secrets_manager_group_acct.secret_group_id
337+
depends_on = [ibm_iam_service_policy.secret_puller_policy, ibm_iam_service_id.secret_puller]
358338
providers = {
359339
ibm = ibm.ibm-sm
360340
}
@@ -403,7 +383,7 @@ module "sm_userpass_secret" {
403383
version = "1.7.0"
404384
region = local.sm_region
405385
secrets_manager_guid = local.sm_guid
406-
secret_group_id = local.sm_acct_id
386+
secret_group_id = module.secrets_manager_group_acct.secret_group_id
407387
#tfsec:ignore:general-secrets-no-plaintext-exposure
408388
secret_name = "${var.prefix}-usernamepassword-secret" # checkov:skip=CKV_SECRET_6
409389
secret_description = "example secret in existing secret manager instance" #tfsec:ignore:general-secrets-no-plaintext-exposure # checkov:skip=CKV_SECRET_6

0 commit comments

Comments
 (0)