feat: updated the service_credential_secrets input object schema of the DA to support creating service specific roles<br>* The service_credentials_source_service_role attribute has been renamed to service_credentials_source_service_role_crn and now requires a full CRN value. For example: service_credentials_source_service_role_crn = "crn:v1:bluemix:public:iam::::role:Editor" (#389)

shemau · web-flow · commit e06dfff5b26e · 2025-02-04T12:56:01.000Z
diff --git a/.secrets.baseline b/.secrets.baseline
@@ -3,7 +3,7 @@
     "files": "go.sum|^.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2024-12-09T17:04:45Z",
+  "generated_at": "2025-01-27T10:25:29Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"
@@ -103,14 +103,6 @@
         "line_number": 64,
         "type": "Secret Keyword",
         "verified_result": null
-      },
-      {
-        "hashed_secret": "1e5c2f367f02e47a8c160cda1cd9d91decbac441",
-        "is_secret": false,
-        "is_verified": false,
-        "line_number": 192,
-        "type": "Secret Keyword",
-        "verified_result": null
       }
     ]
   },
diff --git a/examples/complete/main.tf b/examples/complete/main.tf
@@ -95,7 +95,7 @@ module "icd_elasticsearch" {
 module "secrets_manager" {
   count                = var.existing_sm_instance_guid == null ? 1 : 0
   source               = "terraform-ibm-modules/secrets-manager/ibm"
-  version              = "1.20.0"
+  version              = "1.22.0"
   resource_group_id    = module.resource_group.resource_group_id
   region               = var.region
   secrets_manager_name = "${var.prefix}-secrets-manager"
diff --git a/solutions/standard/DA-types.md b/solutions/standard/DA-types.md
@@ -156,7 +156,7 @@ To enter a custom value, use the edit action to open the "Edit Array" panel. Add
 ### Options for service_credentials
 
 - `secret_name`: (required): A unique human-readable name of the secret to create.
-- `service_credentials_source_service_role`: (required): The role to give the service credential in the Databases for Elasticsearch service. Acceptable values are `Writer`, `Reader`, `Manager`, and `None`
+- `service_credentials_source_service_role_crn`: (required): The CRN of the role to give the service credential in the IBM Cloud Database service. Service credentials role CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role.
 - `secret_labels`: (optional, default = `[]`): Labels of the secret to create. Up to 30 labels can be created. Labels can be 2 - 30 characters, including spaces. Special characters that are not permitted include the angled brackets (<>), comma (,), colon (:), ampersand (&), and vertical pipe character (|).
 - `secret_auto_rotation`: (optional, default = `true`): Whether to configure automatic rotation of service credential.
 - `secret_auto_rotation_unit`: (optional, default = `day`): Specifies the unit of time for rotation of a secret. Acceptable values are `day` or `month`.
@@ -170,11 +170,11 @@ The following example includes all the configuration options for four service cr
   {
     "secret_group_name": "sg-1"
     "existing_secret_group": true
-    "service_credentials": [
+    "service_credentials": [                                              # pragma: allowlist secret
       {
         "secret_name": "cred-1"
-        "service_credentials_source_service_role":  "Writer"
-        "secret_labels": ["test-writer-1", "test-writer-2"]
+        "service_credentials_source_service_role_crn":  "crn:v1:bluemix:public:iam::::role:Editor"
+        "secret_labels": ["test-editor-1", "test-editor-2"]
         "secret_auto_rotation": true
         "secret_auto_rotation_unit": "day"
         "secret_auto_rotation_interval": 89
@@ -183,20 +183,16 @@ The following example includes all the configuration options for four service cr
       },
       {
         "secret_name": "cred-2"
-        "service_credentials_source_service_role": "Reader"
+        "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"
       }
     ]
   },
   {
     "secret_group_name": "sg-2"
-    "service_credentials": [
+    "service_credentials": [                                              # pragma: allowlist secret
       {
         "secret_name": "cred-3"
-        "service_credentials_source_service_role": "Editor"
-      },
-      {
-        "secret_name": "cred-4"
-        "service_credentials_source_service_role": "None"
+        "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"
       }
     ]
   }
diff --git a/solutions/standard/main.tf b/solutions/standard/main.tf
@@ -381,16 +381,16 @@ locals {
       existing_secret_group    = service_credentials.existing_secret_group
       secrets = [
         for secret in service_credentials.service_credentials : {
-          secret_name                             = secret.secret_name
-          secret_labels                           = secret.secret_labels
-          secret_auto_rotation                    = secret.secret_auto_rotation
-          secret_auto_rotation_unit               = secret.secret_auto_rotation_unit
-          secret_auto_rotation_interval           = secret.secret_auto_rotation_interval
-          service_credentials_ttl                 = secret.service_credentials_ttl
-          service_credential_secret_description   = secret.service_credential_secret_description
-          service_credentials_source_service_role = secret.service_credentials_source_service_role
-          service_credentials_source_service_crn  = local.elasticsearch_crn
-          secret_type                             = "service_credentials" #checkov:skip=CKV_SECRET_6
+          secret_name                                 = secret.secret_name
+          secret_labels                               = secret.secret_labels
+          secret_auto_rotation                        = secret.secret_auto_rotation
+          secret_auto_rotation_unit                   = secret.secret_auto_rotation_unit
+          secret_auto_rotation_interval               = secret.secret_auto_rotation_interval
+          service_credentials_ttl                     = secret.service_credentials_ttl
+          service_credential_secret_description       = secret.service_credential_secret_description
+          service_credentials_source_service_role_crn = secret.service_credentials_source_service_role_crn
+          service_credentials_source_service_crn      = local.elasticsearch_crn
+          secret_type                                 = "service_credentials" #checkov:skip=CKV_SECRET_6
         }
       ]
     }
@@ -420,7 +420,7 @@ module "secrets_manager_service_credentials" {
   count                       = var.existing_secrets_manager_instance_crn == null ? 0 : 1
   depends_on                  = [time_sleep.wait_for_es_authorization_policy]
   source                      = "terraform-ibm-modules/secrets-manager/ibm//modules/secrets"
-  version                     = "1.20.0"
+  version                     = "1.22.0"
   existing_sm_instance_guid   = local.existing_secrets_manager_instance_guid
   existing_sm_instance_region = local.existing_secrets_manager_instance_region
   endpoint_type               = var.existing_secrets_manager_endpoint_type
diff --git a/solutions/standard/variables.tf b/solutions/standard/variables.tf
@@ -296,30 +296,29 @@ variable "service_credential_secrets" {
     secret_group_description = optional(string)
     existing_secret_group    = optional(bool)
     service_credentials = list(object({
-      secret_name                             = string
-      service_credentials_source_service_role = string
-      secret_labels                           = optional(list(string))
-      secret_auto_rotation                    = optional(bool)
-      secret_auto_rotation_unit               = optional(string)
-      secret_auto_rotation_interval           = optional(number)
-      service_credentials_ttl                 = optional(string)
-      service_credential_secret_description   = optional(string)
+      secret_name                                 = string
+      service_credentials_source_service_role_crn = string
+      secret_labels                               = optional(list(string))
+      secret_auto_rotation                        = optional(bool)
+      secret_auto_rotation_unit                   = optional(string)
+      secret_auto_rotation_interval               = optional(number)
+      service_credentials_ttl                     = optional(string)
+      service_credential_secret_description       = optional(string)
 
     }))
   }))
   default     = []
   description = "Service credential secrets configuration for Databases for Elasticsearch. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/blob/main/solutions/standard/DA-types.md#service-credential-secrets)."
 
   validation {
+    # Service roles CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role
     condition = alltrue([
       for group in var.service_credential_secrets : alltrue([
-        for credential in group.service_credentials : contains(
-          ["Writer", "Reader", "Manager", "None"], credential.service_credentials_source_service_role
-        )
+        # crn:v?:bluemix; two non-empty segments; three possibly empty segments; :serviceRole or role: non-empty segment
+        for credential in group.service_credentials : can(regex("^crn:v[0-9]:bluemix(:..*){2}(:.*){3}:(serviceRole|role):..*$", credential.service_credentials_source_service_role_crn))
       ])
     ])
-    error_message = "service_credentials_source_service_role role must be one of 'Writer', 'Reader', 'Manager', and 'None'."
-
+    error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles"
   }
 }
 
diff --git a/tests/pr_test.go b/tests/pr_test.go
@@ -106,11 +106,11 @@ func TestRunStandardSolutionSchematics(t *testing.T) {
 			"service_credentials": []map[string]string{
 				{
 					"secret_name": fmt.Sprintf("%s-cred-reader", options.Prefix),
-					"service_credentials_source_service_role": "Reader",
+					"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer",
 				},
 				{
 					"secret_name": fmt.Sprintf("%s-cred-writer", options.Prefix),
-					"service_credentials_source_service_role": "Writer",
+					"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor",
 				},
 			},
 		},

Original file line number	Diff line number	Diff line change
`@@ -156,7 +156,7 @@ To enter a custom value, use the edit action to open the "Edit Array" panel. Add`
`156`	`156`	`### Options for service_credentials`
`157`	`157`
`158`	`158`	- `secret_name`: (required): A unique human-readable name of the secret to create.
`159`		-- `service_credentials_source_service_role`: (required): The role to give the service credential in the Databases for Elasticsearch service. Acceptable values are `Writer`, `Reader`, `Manager`, and `None`
	`159`	+- `service_credentials_source_service_role_crn`: (required): The CRN of the role to give the service credential in the IBM Cloud Database service. Service credentials role CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role.
`160`	`160`	- `secret_labels`: (optional, default = `[]`): Labels of the secret to create. Up to 30 labels can be created. Labels can be 2 - 30 characters, including spaces. Special characters that are not permitted include the angled brackets (<>), comma (,), colon (:), ampersand (&), and vertical pipe character (\|).
`161`	`161`	- `secret_auto_rotation`: (optional, default = `true`): Whether to configure automatic rotation of service credential.
`162`	`162`	- `secret_auto_rotation_unit`: (optional, default = `day`): Specifies the unit of time for rotation of a secret. Acceptable values are `day` or `month`.
`@@ -170,11 +170,11 @@ The following example includes all the configuration options for four service cr`
`170`	`170`	`{`
`171`	`171`	`"secret_group_name": "sg-1"`
`172`	`172`	`"existing_secret_group": true`
`173`		`- "service_credentials": [`
	`173`	`+ "service_credentials": [ # pragma: allowlist secret`
`174`	`174`	`{`
`175`	`175`	`"secret_name": "cred-1"`
`176`		`- "service_credentials_source_service_role": "Writer"`
`177`		`- "secret_labels": ["test-writer-1", "test-writer-2"]`
	`176`	`+ "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor"`
	`177`	`+ "secret_labels": ["test-editor-1", "test-editor-2"]`
`178`	`178`	`"secret_auto_rotation": true`
`179`	`179`	`"secret_auto_rotation_unit": "day"`
`180`	`180`	`"secret_auto_rotation_interval": 89`
`@@ -183,20 +183,16 @@ The following example includes all the configuration options for four service cr`
`183`	`183`	`},`
`184`	`184`	`{`
`185`	`185`	`"secret_name": "cred-2"`
`186`		`- "service_credentials_source_service_role": "Reader"`
	`186`	`+ "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"`
`187`	`187`	`}`
`188`	`188`	`]`
`189`	`189`	`},`
`190`	`190`	`{`
`191`	`191`	`"secret_group_name": "sg-2"`
`192`		`- "service_credentials": [`
	`192`	`+ "service_credentials": [ # pragma: allowlist secret`
`193`	`193`	`{`
`194`	`194`	`"secret_name": "cred-3"`
`195`		`- "service_credentials_source_service_role": "Editor"`
`196`		`- },`
`197`		`- {`
`198`		`- "secret_name": "cred-4"`
`199`		`- "service_credentials_source_service_role": "None"`
	`195`	`+ "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"`
`200`	`196`	`}`
`201`	`197`	`]`
`202`	`198`	`}`
Original file line number	Diff line number	Diff line change
`@@ -106,11 +106,11 @@ func TestRunStandardSolutionSchematics(t *testing.T) {`
`106`	`106`	`"service_credentials": []map[string]string{`
`107`	`107`	`{`
`108`	`108`	`"secret_name": fmt.Sprintf("%s-cred-reader", options.Prefix),`
`109`		`- "service_credentials_source_service_role": "Reader",`
	`109`	`+ "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer",`
`110`	`110`	`},`
`111`	`111`	`{`
`112`	`112`	`"secret_name": fmt.Sprintf("%s-cred-writer", options.Prefix),`
`113`		`- "service_credentials_source_service_role": "Writer",`
	`113`	`+ "service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor",`
`114`	`114`	`},`
`115`	`115`	`},`
`116`	`116`	`},`