Skip to content

Commit 1afeca2

Browse files
whofflerwhoffler
committed
Security enforced variation + variable validation
1 parent 4f15ba5 commit 1afeca2

File tree

13 files changed

+729
-102
lines changed

13 files changed

+729
-102
lines changed

‎cra-config.yaml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,11 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "solutions/standard" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "solutions/fully-configurable" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
66
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
77
CRA_ENVIRONMENT_VARIABLES:
88
TF_VAR_existing_kms_instance_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9::"
99
TF_VAR_existing_kms_key_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:76170fae-4e0c-48c3-8ebe-326059ebb533"
1010
TF_VAR_provider_visibility: "public"
11-
TF_VAR_resource_group_name: "test-es-cra"
12-
TF_VAR_use_existing_resource_group: false
11+
TF_VAR_existing_resource_group_name: "geretain-test-elasticsearch"

‎ibm_catalog.json‎

Lines changed: 21 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
"nosql"
2323
],
2424
"short_description": "Creates and configures an instance of IBM Cloud Databases for Elasticsearch.",
25-
"long_description": "This architecture supports creating and configuring an instance of Databases for Elasticsearch with KMS encryption.",
25+
"long_description": "This architecture supports creating and configuring an instance of [Databases for Elasticsearch](https://www.ibm.com/products/databases-for-elasticsearch), with optional KMS encryption. This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) asset collection, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
2626
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/blob/main/README.md",
2727
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/main/images/elasticsearch_icon.svg",
2828
"provider_name": "IBM",
@@ -183,7 +183,7 @@
183183
]
184184
},
185185
{
186-
"key": "name"
186+
"key": "elasticsearch_name"
187187
},
188188
{
189189
"key": "existing_elasticsearch_instance_crn"
@@ -202,7 +202,17 @@
202202
]
203203
},
204204
{
205-
"key": "service_endpoints"
205+
"key": "service_endpoints",
206+
"options": [
207+
{
208+
"displayname": "private",
209+
"value": "private"
210+
},
211+
{
212+
"displayname": "public",
213+
"value": "public"
214+
}
215+
]
206216
},
207217
{
208218
"key": "elasticsearch_version",
@@ -228,7 +238,7 @@
228238
]
229239
},
230240
{
231-
"key": "tags"
241+
"key": "elasticsearch_tags"
232242
},
233243
{
234244
"key": "elasticsearch_access_tags"
@@ -333,7 +343,7 @@
333343
"key": "skip_es_kms_auth_policy"
334344
},
335345
{
336-
"key": "backup_crn"
346+
"key": "elasticsearch_backup_crn"
337347
},
338348
{
339349
"key": "enable_elser_model"
@@ -399,10 +409,10 @@
399409
]
400410
},
401411
{
402-
"label": "Fully configurable",
403-
"name": "fully-configurable",
412+
"label": "Security Enforced",
413+
"name": "security-enforced",
404414
"install_type": "fullstack",
405-
"working_directory": "solutions/fully-configurable",
415+
"working_directory": "solutions/security-enforced",
406416
"compliance": {
407417
"authority": "scc-v3",
408418
"profiles": [
@@ -443,23 +453,6 @@
443453
{
444454
"key": "ibmcloud_api_key"
445455
},
446-
{
447-
"key": "provider_visibility",
448-
"options": [
449-
{
450-
"displayname": "private",
451-
"value": "private"
452-
},
453-
{
454-
"displayname": "public",
455-
"value": "public"
456-
},
457-
{
458-
"displayname": "public-and-private",
459-
"value": "public-and-private"
460-
}
461-
]
462-
},
463456
{
464457
"key": "existing_resource_group_name",
465458
"required": true,
@@ -532,7 +525,7 @@
532525
]
533526
},
534527
{
535-
"key": "name"
528+
"key": "elasticsearch_name"
536529
},
537530
{
538531
"key": "existing_elasticsearch_instance_crn"
@@ -550,9 +543,6 @@
550543
}
551544
]
552545
},
553-
{
554-
"key": "service_endpoints"
555-
},
556546
{
557547
"key": "elasticsearch_version",
558548
"required": false,
@@ -577,7 +567,7 @@
577567
]
578568
},
579569
{
580-
"key": "tags"
570+
"key": "elasticsearch_tags"
581571
},
582572
{
583573
"key": "elasticsearch_access_tags"
@@ -612,19 +602,6 @@
612602
{
613603
"key": "existing_secrets_manager_instance_crn"
614604
},
615-
{
616-
"key": "existing_secrets_manager_endpoint_type",
617-
"options": [
618-
{
619-
"displayname": "public",
620-
"value": "public"
621-
},
622-
{
623-
"displayname": "private",
624-
"value": "private"
625-
}
626-
]
627-
},
628605
{
629606
"key": "service_credential_secrets"
630607
},
@@ -643,19 +620,6 @@
643620
{
644621
"key": "ibmcloud_kms_api_key"
645622
},
646-
{
647-
"key": "kms_endpoint_type",
648-
"options": [
649-
{
650-
"displayname": "public",
651-
"value": "public"
652-
},
653-
{
654-
"displayname": "private",
655-
"value": "private"
656-
}
657-
]
658-
},
659623
{
660624
"key": "use_ibm_owned_encryption_key"
661625
},
@@ -682,7 +646,7 @@
682646
"key": "skip_es_kms_auth_policy"
683647
},
684648
{
685-
"key": "backup_crn"
649+
"key": "elasticsearch_backup_crn"
686650
},
687651
{
688652
"key": "enable_elser_model"
@@ -725,23 +689,6 @@
725689
{
726690
"key": "kibana_image_port"
727691
},
728-
{
729-
"key": "kibana_visibility",
730-
"options": [
731-
{
732-
"displayname": "local_public",
733-
"value": "local_public"
734-
},
735-
{
736-
"displayname": "local_private",
737-
"value": "local_private"
738-
},
739-
{
740-
"displayname": "local",
741-
"value": "local"
742-
}
743-
]
744-
},
745692
{
746693
"key": "cbr_rules"
747694
}

‎solutions/fully-configurable/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1-
# IBM Cloud Databases for Elasticsearch
1+
# IBM Cloud Databases for Elasticsearch (Fully Configurable)
2+
3+
## Prerequisites
4+
- An existing resource group
25

36
This architecture creates an instance of IBM Cloud Databases for Elasticsearch and supports provisioning of the following resources:
47

‎solutions/fully-configurable/catalogValidationValues.json.template‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
{
22
"ibmcloud_api_key": $VALIDATION_APIKEY,
33
"region": "us-south",
4-
"tags": $TAGS,
5-
"name": $PREFIX,
4+
"elasticsearch_tags": $TAGS,
5+
"elasticsearch_name": $PREFIX,
66
"existing_resource_group_name": "geretain-test-permanent",
77
"existing_kms_instance_crn": $HPCS_US_SOUTH_CRN
88
}

‎solutions/fully-configurable/main.tf‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -278,7 +278,7 @@ module "elasticsearch" {
278278
source = "../.."
279279
depends_on = [time_sleep.wait_for_authorization_policy, time_sleep.wait_for_backup_kms_authorization_policy]
280280
resource_group_id = module.resource_group.resource_group_id
281-
name = (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.name}" : var.name
281+
name = (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.elasticsearch_name}" : var.elasticsearch_name
282282
region = var.region
283283
plan = var.plan
284284
skip_iam_authorization_policy = var.skip_es_kms_auth_policy
@@ -289,9 +289,9 @@ module "elasticsearch" {
289289
backup_encryption_key_crn = local.backup_kms_key_crn
290290
use_same_kms_key_for_backups = local.use_same_kms_key_for_backups
291291
use_default_backup_encryption_key = var.use_default_backup_encryption_key
292-
backup_crn = var.backup_crn
292+
backup_crn = var.elasticsearch_backup_crn
293293
access_tags = var.elasticsearch_access_tags
294-
tags = var.tags
294+
tags = var.elasticsearch_tags
295295
admin_pass = local.admin_pass
296296
users = var.users
297297
members = var.members
@@ -322,14 +322,6 @@ locals {
322322
#######################################################################################################################
323323

324324
locals {
325-
## Variable validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
326-
# tflint-ignore: terraform_unused_declarations
327-
validate_sm_crn = length(local.service_credential_secrets) > 0 && var.existing_secrets_manager_instance_crn == null ? tobool("`existing_secrets_manager_instance_crn` is required when adding service credentials to a secrets manager secret.") : false
328-
# tflint-ignore: terraform_unused_declarations
329-
validate_sm_sg = var.existing_secrets_manager_instance_crn != null && var.admin_pass_secrets_manager_secret_group == null ? tobool("`admin_pass_secrets_manager_secret_group` is required when `existing_secrets_manager_instance_crn` is set.") : false
330-
# tflint-ignore: terraform_unused_declarations
331-
validate_sm_sn = var.existing_secrets_manager_instance_crn != null && var.admin_pass_secrets_manager_secret_name == null ? tobool("`admin_pass_secrets_manager_secret_name` is required when `existing_secrets_manager_instance_crn` is set.") : false
332-
333325
create_sm_auth_policy = var.skip_elasticsearch_to_secrets_manager_auth_policy || var.existing_secrets_manager_instance_crn == null ? 0 : 1
334326
}
335327

‎solutions/fully-configurable/outputs.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,3 +59,19 @@ output "kibana_app_endpoint" {
5959
description = "Code Engine Kibana endpoint URL"
6060
value = var.enable_kibana_dashboard ? module.code_engine_kibana[0].app[local.code_engine_app_name].endpoint : null
6161
}
62+
63+
output "cbr_rule_ids" {
64+
description = "CBR rule ids created to restrict Elasticsearch"
65+
value = module.elasticsearch[0].cbr_rule_ids != null ? module.elasticsearch[0].cbr_rule_ids : null
66+
}
67+
68+
output "adminuser" {
69+
description = "Database admin user name"
70+
value = module.elasticsearch[0].adminuser != null ? module.elasticsearch[0].adminuser : null
71+
}
72+
73+
output "certificate_base64" {
74+
description = "Database connection certificate"
75+
value = module.elasticsearch[0].certificate_base64 != null ? module.elasticsearch[0].certificate_base64 : null
76+
sensitive = true
77+
}

0 commit comments

Comments
 (0)