You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: added the ability to use the default IBM Cloud® Databases randomly generated keys for disk and backups encryption in the fscloud submodule, and the DA using new input use_ibm_owned_encryption_key<br>* Exposed the ability to set the IBM terraform provider visability in the DA using new input provider_visibility ([Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints))<br>* updated the scope of the KMS auth policy that is created so the policy is now scoped to the exact KMS key. If upgrading from a previous version, this will destroy the old policy, however the new one will be created before its destroyed to ensure no impact to every day services.<br>* Fixed an issue in the original ICD hosting model logic for conditionally including the group block during a database restore operation (#330)
Copy file name to clipboardExpand all lines: README.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -91,7 +91,7 @@ You need the following permissions to run this module.
91
91
| <aname="input_admin_pass"></a> [admin\_pass](#input\_admin\_pass)| The password for the database administrator. If the admin password is null, the admin user ID cannot be accessed. You can specify more users in a user block. |`string`|`null`| no |
92
92
| <a name="input_auto_scaling"></a> [auto\_scaling](#input\_auto\_scaling) | The rules to allow the database to increase resources in response to usage. Only a single autoscaling block is allowed. Make sure you understand the effects of autoscaling, especially for production environments. [Learn more](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-autoscaling&interface=cli#autoscaling-considerations). | <pre>object({<br/> disk = object({<br/> capacity_enabled = optional(bool, false)<br/> free_space_less_than_percent = optional(number, 10)<br/> io_above_percent = optional(number, 90)<br/> io_enabled = optional(bool, false)<br/> io_over_period = optional(string, "15m")<br/> rate_increase_percent = optional(number, 10)<br/> rate_limit_mb_per_member = optional(number, 3670016)<br/> rate_period_seconds = optional(number, 900)<br/> rate_units = optional(string, "mb")<br/> })<br/> memory = object({<br/> io_above_percent = optional(number, 90)<br/> io_enabled = optional(bool, false)<br/> io_over_period = optional(string, "15m")<br/> rate_increase_percent = optional(number, 10)<br/> rate_limit_mb_per_member = optional(number, 114688)<br/> rate_period_seconds = optional(number, 900)<br/> rate_units = optional(string, "mb")<br/> })<br/> })</pre> | `null` | no |
93
93
| <aname="input_backup_crn"></a> [backup\_crn](#input\_backup\_crn)| The CRN of a backup resource to restore from. The backup is created by a database deployment with the same service ID. The backup is loaded after both provisioning is complete and the new deployment that uses that data starts. Specify a backup CRN is in the format `crn:v1:<...>:backup:`. If not specified, the database is provisioned empty. |`string`|`null`| no |
94
-
| <aname="input_backup_encryption_key_crn"></a> [backup\_encryption\_key\_crn](#input\_backup\_encryption\_key\_crn)| The CRN of a KMS (Key Protect or Hyper Protect Crypto Services) key to use for encrypting the disk that holds deployment backups. Applies only if `kms_encryption_enabled` is true. Limitations exist for regions. For more information, see [Key Protect integration](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) or [Hyper Protect Crypto Services integration](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups).|`string`|`null`| no |
94
+
| <aname="input_backup_encryption_key_crn"></a> [backup\_encryption\_key\_crn](#input\_backup\_encryption\_key\_crn)| The CRN of a Hyper Protect Crypto Servicesuse for encrypting the disk that holds deployment backups. There are limitation per region on the Hyper Protect Crypto Services and region for those services. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups|`string`|`null`| no |
95
95
| <aname="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules)| The list of context-based restriction rules to create. | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> }))</pre> |`[]`| no |
96
96
| <aname="input_elasticsearch_version"></a> [elasticsearch\_version](#input\_elasticsearch\_version)| The version of Databases for Elasticsearch to deploy. Possible values: `8.7`, `8.10`, `8.12`, `8.15` which requires an Enterprise Platinum pricing plan. If no value is specified, the current preferred version for IBM Cloud Databases is used. |`string`|`null`| no |
97
97
| <aname="input_elser_model_type"></a> [elser\_model\_type](#input\_elser\_model\_type)| Trained ELSER model to be used for Elastic's Natural Language Processing. Possible values: `.elser_model_1`, `.elser_model_2` and `.elser_model_2_linux-x86_64`. [Learn more](https://www.elastic.co/guide/en/machine-learning/current/ml-nlp-elser.html)|`string`|`".elser_model_2_linux-x86_64"`| no |
@@ -112,7 +112,7 @@ You need the following permissions to run this module.
112
112
| <aname="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints)| The type of endpoint of the database instance. Possible values: `public`, `private`, `public-and-private`. |`string`|`"public"`| no |
113
113
| <aname="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy)| Whether to create an IAM authorization policy that permits all Databases for Elasticsearch instances in the resource group to read the encryption key from the Hyper Protect Crypto Services instance specified in the `existing_kms_instance_guid` variable. If set to `false`, specify a value for the KMS instance in the `existing_kms_instance_guid` variable. No policy is created if `kms_encryption_enabled` is false. |`bool`|`false`| no |
114
114
| <aname="input_tags"></a> [tags](#input\_tags)| The list of tags to be added to the Databases for Elasticsearch instance. |`list(string)`|`[]`| no |
115
-
| <aname="input_use_default_backup_encryption_key"></a> [use\_default\_backup\_encryption\_key](#input\_use\_default\_backup\_encryption\_key)| Whether to use the IBM Cloud Databases generated keys. |`bool`|`false`| no |
115
+
| <aname="input_use_default_backup_encryption_key"></a> [use\_default\_backup\_encryption\_key](#input\_use\_default\_backup\_encryption\_key)| Whether to use the IBM Cloud Databases generated keys for backup encryption. |`bool`|`false`| no |
116
116
| <aname="input_users"></a> [users](#input\_users)| The list of users that have access to the database. Multiple blocks are allowed. The user password must be 10-32 characters. In most cases, you can use IAM service credentials (by specifying `service_credential_names`) to control access to the database instance. This block creates native database users. [Learn more](https://cloud.ibm.com/docs/databases-for-elasticsearch?topic=databases-for-elasticsearch-user-management&interface=ui). | <pre>list(object({<br/> name = string<br/> password = string # pragma: allowlist secret<br/> type = optional(string)<br/> role = optional(string)<br/> }))</pre> |`[]`| no |
Copy file name to clipboardExpand all lines: examples/fscloud/variables.tf
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -104,7 +104,7 @@ variable "backup_crn" {
104
104
105
105
variable"backup_encryption_key_crn" {
106
106
type=string
107
-
description="The CRN of a Hyper Protect Crypto Services use for encrypting the disk that holds deployment backups. Only used if var.kms_encryption_enabled is set to true. There are limitation per region on the Hyper Protect Crypto Services and region for those services. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups"
107
+
description="The CRN of a Hyper Protect Crypto Services use for encrypting the disk that holds deployment backups. There are limitation per region on the Hyper Protect Crypto Services and region for those services. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups"
description="Allow all Elastic Search instances in the resource group ${var.resource_group_id} to read the ${local.kms_service} key ${local.kms_key_id} from the instance GUID ${var.existing_kms_instance_guid}"
44
+
resource_attributes {
45
+
name="serviceName"
46
+
operator="stringEquals"
47
+
value=local.kms_service
48
+
}
49
+
resource_attributes {
50
+
name="accountId"
51
+
operator="stringEquals"
52
+
value=local.kms_account_id
53
+
}
54
+
resource_attributes {
55
+
name="serviceInstance"
56
+
operator="stringEquals"
57
+
value=var.existing_kms_instance_guid
58
+
}
59
+
resource_attributes {
60
+
name="resourceType"
61
+
operator="stringEquals"
62
+
value="key"
63
+
}
64
+
resource_attributes {
65
+
name="resource"
66
+
operator="stringEquals"
67
+
value=local.kms_key_id
68
+
}
69
+
# Scope of policy now includes the key, so ensure to create new policy before
70
+
# destroying old one to prevent any disruption to every day services.
71
+
lifecycle {
72
+
create_before_destroy=true
73
+
}
46
74
}
47
75
48
76
# workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4478
0 commit comments