feat: Added feature to add CBR for Kibana app and other security issues

README.md

@@ -133,6 +133,7 @@ You need the following permissions to run this module.
 | <a name="output_port"></a> [port](#output\_port) | Database connection port |
 | <a name="output_service_credentials_json"></a> [service\_credentials\_json](#output\_service\_credentials\_json) | Service credentials json map |
 | <a name="output_service_credentials_object"></a> [service\_credentials\_object](#output\_service\_credentials\_object) | Service credentials object |
+| <a name="output_users_credentials"></a> [users\_credentials](#output\_users\_credentials) | Database user credentials |
 | <a name="output_version"></a> [version](#output\_version) | Elasticsearch version |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
 

ibm_catalog.json

@@ -367,6 +367,9 @@
             {
               "key": "kibana_image_port"
             },
+            {
+              "key": "cbr_code_engine_kibana_rules"
+            },
             {
               "key": "kibana_visibility",
               "options": [

modules/fscloud/README.md

@@ -71,5 +71,6 @@ No resources.
 | <a name="output_port"></a> [port](#output\_port) | Database connection port |
 | <a name="output_service_credentials_json"></a> [service\_credentials\_json](#output\_service\_credentials\_json) | Service credentials json map |
 | <a name="output_service_credentials_object"></a> [service\_credentials\_object](#output\_service\_credentials\_object) | Service credentials object |
+| <a name="output_users_credentials"></a> [users\_credentials](#output\_users\_credentials) | Database user credentials |
 | <a name="output_version"></a> [version](#output\_version) | Elasticsearch instance version |
 <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

modules/fscloud/outputs.tf

@@ -59,3 +59,9 @@ output "certificate_base64" {
   value       = module.elasticsearch.certificate_base64
   sensitive   = true
 }
+
+output "users_credentials" {
+  description = "Database user credentials"
+  value       = module.elasticsearch.users_credentials
+  sensitive   = true
+}

outputs.tf

@@ -44,6 +44,12 @@ output "adminuser" {
   value       = ibm_database.elasticsearch.adminuser
 }
 
+output "users_credentials" {
+  description = "Database user credentials"
+  value       = ibm_database.elasticsearch.users
+  sensitive   = true
+}
+
 output "hostname" {
   description = "Database connection hostname"
   value       = data.ibm_database_connection.database_connection.https[0].hosts[0].hostname

solutions/standard/main.tf

@@ -293,7 +293,6 @@ module "elasticsearch" {
   access_tags                       = var.access_tags
   tags                              = var.tags
   admin_pass                        = local.admin_pass
-  users                             = var.users
   members                           = var.members
   member_host_flavor                = var.member_host_flavor
   member_memory_mb                  = var.member_memory_mb
@@ -304,6 +303,13 @@ module "elasticsearch" {
   enable_elser_model                = var.enable_elser_model
   elser_model_type                  = var.elser_model_type
   cbr_rules                         = var.cbr_rules
+  users = var.enable_kibana_dashboard && local.kibana_app_login_password != null ? [
+    {
+      "name" : "kibana_user",
+      "password" : local.kibana_app_login_password,
+      "type" : "database",
+    }
+  ] : var.users
 }
 
 locals {
@@ -411,11 +417,30 @@ module "secrets_manager_service_credentials" {
 # Code Engine Kibana Dashboard instance
 ########################################################################################################################
 
+resource "random_password" "kibana_system_password" {
+  count            = var.enable_kibana_dashboard ? 1 : 0
+  length           = 32
+  special          = true
+  override_special = "-_"
+  min_numeric      = 1
+}
+
+resource "random_password" "kibana_app_login_password" {
+  count            = var.enable_kibana_dashboard ? 1 : 0
+  length           = 32
+  special          = true
+  override_special = "-_"
+  min_numeric      = 1
+}
+
 locals {
-  code_engine_project_id   = var.existing_code_engine_project_id != null ? var.existing_code_engine_project_id : null
-  code_engine_project_name = local.code_engine_project_id != null ? null : (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.kibana_code_engine_new_project_name}" : var.kibana_code_engine_new_project_name
-  code_engine_app_name     = (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.kibana_code_engine_new_app_name}" : var.kibana_code_engine_new_app_name
-  kibana_version           = var.enable_kibana_dashboard ? jsondecode(data.http.es_metadata[0].response_body).version.number : null
+  code_engine_project_id    = var.existing_code_engine_project_id != null ? var.existing_code_engine_project_id : null
+  code_engine_project_name  = local.code_engine_project_id != null ? null : (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.kibana_code_engine_new_project_name}" : var.kibana_code_engine_new_project_name
+  code_engine_app_name      = (var.prefix != null && var.prefix != "") ? "${var.prefix}-${var.kibana_code_engine_new_app_name}" : var.kibana_code_engine_new_app_name
+  kibana_version            = var.enable_kibana_dashboard ? jsondecode(data.http.es_metadata[0].response_body).version.number : null
+  deployment_id             = urlencode(local.elasticsearch_id)
+  kibana_system_password    = var.enable_kibana_dashboard ? random_password.kibana_system_password[0].result : null
+  kibana_app_login_password = var.enable_kibana_dashboard ? random_password.kibana_app_login_password[0].result : null
 }
 
 data "http" "es_metadata" {
@@ -431,11 +456,12 @@ module "code_engine_kibana" {
   resource_group_id   = module.resource_group.resource_group_id
   project_name        = local.code_engine_project_name
   existing_project_id = local.code_engine_project_id
+  cbr_rules           = var.cbr_code_engine_kibana_rules
   secrets = {
     "es-secret" = {
       format = "generic"
       data = {
-        "ELASTICSEARCH_PASSWORD" = local.admin_pass
+        "ELASTICSEARCH_PASSWORD" = local.kibana_system_password
       }
     }
   }
@@ -452,7 +478,7 @@ module "code_engine_kibana" {
         {
           type  = "literal"
           name  = "ELASTICSEARCH_USERNAME"
-          value = local.elasticsearch_username
+          value = "kibana_system"
         },
         {
           type      = "secret_key_reference"
@@ -482,3 +508,18 @@ module "code_engine_kibana" {
     }
   }
 }
+
+# Set Elasticsearch built-in kibana_user password
+resource "restapi_object" "set_kibana_system_user_password" {
+  count          = var.enable_kibana_dashboard ? 1 : 0
+  path           = "/v5/ibm/deployments/${local.deployment_id}/users/database/kibana_system"
+  create_method  = "PATCH"
+  update_method  = "PATCH"
+  destroy_method = "PATCH"
+  object_id      = "kibana_system"
+  data = jsonencode({
+    user = {
+      password = local.kibana_system_password
+    }
+  })
+}

solutions/standard/outputs.tf

@@ -59,3 +59,12 @@ output "kibana_app_endpoint" {
   description = "Code Engine Kibana endpoint URL"
   value       = var.enable_kibana_dashboard ? module.code_engine_kibana[0].app[local.code_engine_app_name].endpoint : null
 }
+
+output "kibana_user_credentials" {
+  description = "Kibana user credentials for Elasticsearch"
+  value = var.enable_kibana_dashboard ? {
+    for user in module.elasticsearch[0].users_credentials : user.name => user.password
+    if user.type == "database"
+  } : null
+  sensitive = true
+}

solutions/standard/provider.tf

@@ -10,3 +10,13 @@ provider "ibm" {
   region           = local.kms_region
   visibility       = var.provider_visibility
 }
+
+data "ibm_iam_auth_token" "auth_token" {}
+provider "restapi" {
+  uri = "https://api.${var.region}.private.databases.cloud.ibm.com"
+  headers = {
+    Authorization = data.ibm_iam_auth_token.auth_token.iam_access_token
+    Content-Type  = "application/json"
+  }
+  write_returns_object = true
+}

solutions/standard/variables.tf

@@ -449,9 +449,8 @@ variable "kibana_image_digest" {
     condition     = var.kibana_image_digest == null || can(regex("^sha256:", var.kibana_image_digest))
     error_message = "If provided, the value of kibana_image_digest must start with 'sha256:'."
   }
-
-
 }
+
 variable "kibana_image_port" {
   description = "Specify the port number used to connect to the Kibana service exposed by the container image. Default port is 5601 and it is only applicable if `enable_kibana_dashboard` is true"
   type        = number
@@ -491,3 +490,23 @@ variable "cbr_rules" {
   description = "(Optional, list) List of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/tree/main/solutions/standard/DA-cbr_rules.md)"
   default     = []
 }
+
+variable "cbr_code_engine_kibana_rules" {
+  type = list(object({
+    description = string
+    account_id  = string
+    rule_contexts = list(object({
+      attributes = optional(list(object({
+        name  = string
+        value = string
+    }))) }))
+    enforcement_mode = string
+    operations = optional(list(object({
+      api_types = list(object({
+        api_type_id = string
+      }))
+    })))
+  }))
+  description = "(Optional, list) List of context-based restrictions rules to create for the Kibana dashboard. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-icd-elasticsearch/tree/main/solutions/standard/DA-cbr_rules.md)"
+  default     = []
+}

solutions/standard/version.tf

@@ -19,5 +19,9 @@ terraform {
       source  = "hashicorp/http"
       version = "3.5.0"
     }
+    restapi = {
+      source  = "Mastercard/restapi"
+      version = ">=1.20.0, <2.0.0"
+    }
   }
 }