Skip to content

Commit 0033558

Browse files
whofflerwhoffler
committed
security enforced variation
1 parent f9a4e35 commit 0033558

File tree

11 files changed

+787
-6
lines changed

11 files changed

+787
-6
lines changed

‎ibm_catalog.json‎

Lines changed: 251 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,18 @@
9797
{
9898
"key": "ibmcloud_api_key"
9999
},
100+
{
101+
"key": "existing_resource_group_name",
102+
"required": true,
103+
"custom_config": {
104+
"type": "resource_group",
105+
"grouping": "deployment",
106+
"original_grouping": "deployment",
107+
"config_constraints": {
108+
"identifier": "rg_name"
109+
}
110+
}
111+
},
100112
{
101113
"key": "provider_visibility",
102114
"options": [
@@ -114,9 +126,6 @@
114126
}
115127
]
116128
},
117-
{
118-
"key": "existing_resource_group_name"
119-
},
120129
{
121130
"key": "prefix"
122131
},
@@ -258,7 +267,17 @@
258267
"key": "existing_kms_key_crn"
259268
},
260269
{
261-
"key": "kms_endpoint_type"
270+
"key": "kms_endpoint_type",
271+
"options": [
272+
{
273+
"displayname": "public",
274+
"value": "public"
275+
},
276+
{
277+
"displayname": "private",
278+
"value": "private"
279+
}
280+
]
262281
},
263282
{
264283
"key": "skip_mongodb_kms_auth_policy"
@@ -297,6 +316,234 @@
297316
"key": "skip_mongodb_secrets_manager_auth_policy"
298317
}
299318
]
319+
},
320+
{
321+
"label": "Security Enforced",
322+
"name": "security-enforced",
323+
"install_type": "fullstack",
324+
"working_directory": "solutions/security-enforced",
325+
"compliance": {
326+
"authority": "scc-v3",
327+
"profiles": [
328+
{
329+
"profile_name": "IBM Cloud Framework for Financial Services",
330+
"profile_version": "1.7.0"
331+
}
332+
]
333+
},
334+
"iam_permissions": [
335+
{
336+
"role_crns": [
337+
"crn:v1:bluemix:public:iam::::role:Editor"
338+
],
339+
"service_name": "databases-for-mongodb"
340+
},
341+
{
342+
"role_crns": [
343+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
344+
"crn:v1:bluemix:public:iam::::role:Editor"
345+
],
346+
"service_name": "kms"
347+
}
348+
],
349+
"architecture": {
350+
"descriptions": "This architecture creates an instance of IBM Cloud Databases for MongoDB instance with KMS encryption. Supports autoscaling.",
351+
"features": [
352+
{
353+
"title": " Creates an instance of Databases for MongoDB",
354+
"description": "This architecture creates an instance of IBM Cloud Databases for MongoDB with KMS encryption. It accepts or creates a resource group, and provides autoscaling rules."
355+
}
356+
],
357+
"diagrams": [
358+
{
359+
"diagram": {
360+
"caption": "Databases for MongoDB instance on IBM Cloud",
361+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-mongodb/main/reference-architecture/deployable-architecture-mongodb.svg",
362+
"type": "image/svg+xml"
363+
},
364+
"description": "This architecture supports creating and configuring an instance of Databases for MongoDB instance with KMS encryption."
365+
}
366+
]
367+
},
368+
"configuration": [
369+
{
370+
"key": "ibmcloud_api_key"
371+
},
372+
{
373+
"key": "existing_resource_group_name",
374+
"required": true,
375+
"custom_config": {
376+
"type": "resource_group",
377+
"grouping": "deployment",
378+
"original_grouping": "deployment",
379+
"config_constraints": {
380+
"identifier": "rg_name"
381+
}
382+
}
383+
},
384+
{
385+
"key": "region",
386+
"required": true,
387+
"default_value": "us-south",
388+
"options": [
389+
{
390+
"displayname": "Chennai (che01)",
391+
"value": "che01"
392+
},
393+
{
394+
"displayname": "Dallas (us-south)",
395+
"value": "us-south"
396+
},
397+
{
398+
"displayname": "Frankfurt (eu-de)",
399+
"value": "eu-de"
400+
},
401+
{
402+
"displayname": "London (eu-gb)",
403+
"value": "eu-gb"
404+
},
405+
{
406+
"displayname": "Madrid (eu-es)",
407+
"value": "eu-es"
408+
},
409+
{
410+
"displayname": "Osaka (jp-osa)",
411+
"value": "jp-osa"
412+
},
413+
{
414+
"displayname": "Paris (par01)",
415+
"value": "par01"
416+
},
417+
{
418+
"displayname": "Sao Paulo (br-sao)",
419+
"value": "br-sao"
420+
},
421+
{
422+
"displayname": "Sydney (au-syd)",
423+
"value": "au-syd"
424+
},
425+
{
426+
"displayname": "Toronto (ca-tor)",
427+
"value": "ca-tor"
428+
},
429+
{
430+
"displayname": "Tokyo (jp-tok)",
431+
"value": "jp-tok"
432+
},
433+
{
434+
"displayname": "Washington (us-east)",
435+
"value": "us-east"
436+
}
437+
]
438+
},
439+
{
440+
"key": "prefix"
441+
},
442+
{
443+
"key": "mongodb_name"
444+
},
445+
446+
{
447+
"key": "mongodb_version",
448+
"required": false,
449+
"default_value": "__NULL__",
450+
"options": [
451+
{
452+
"displayname": "preferred",
453+
"value": "__NULL__"
454+
},
455+
{
456+
"displayname": "6.0",
457+
"value": "6.0"
458+
},
459+
{
460+
"displayname": "7.0",
461+
"value": "7.0"
462+
}
463+
]
464+
},
465+
{
466+
"key": "plan"
467+
},
468+
{
469+
"key": "members"
470+
},
471+
{
472+
"key": "memory_mb"
473+
},
474+
{
475+
"key": "cpu_count"
476+
},
477+
{
478+
"key": "disk_mb"
479+
},
480+
{
481+
"key": "member_host_flavor"
482+
},
483+
{
484+
"key": "service_credential_names"
485+
},
486+
{
487+
"key": "admin_pass"
488+
},
489+
{
490+
"key": "admin_pass_secrets_manager_secret_group"
491+
},
492+
{
493+
"key": "admin_pass_secrets_manager_secret_name"
494+
},
495+
{
496+
"key": "existing_mongodb_instance_crn"
497+
},
498+
{
499+
"key": "use_existing_admin_pass_secrets_manager_secret_group"
500+
},
501+
{
502+
"key": "users"
503+
},
504+
{
505+
"key": "mongodb_tags"
506+
},
507+
{
508+
"key": "mongodb_access_tags"
509+
},
510+
{
511+
"key": "existing_kms_instance_crn"
512+
},
513+
{
514+
"key": "existing_kms_key_crn"
515+
},
516+
{
517+
"key": "skip_mongodb_kms_auth_policy"
518+
},
519+
{
520+
"key": "ibmcloud_kms_api_key"
521+
},
522+
{
523+
"key": "key_ring_name"
524+
},
525+
{
526+
"key": "key_name"
527+
},
528+
{
529+
"key": "existing_backup_kms_key_crn"
530+
},
531+
{
532+
"key": "auto_scaling"
533+
},
534+
{
535+
"key": "backup_crn"
536+
},
537+
{
538+
"key": "existing_secrets_manager_instance_crn"
539+
},
540+
{
541+
"key": "service_credential_secrets"
542+
},
543+
{
544+
"key": "skip_mongodb_secrets_manager_auth_policy"
545+
}
546+
]
300547
}
301548
]
302549
}

‎solutions/fully-configurable/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# IBM Cloud Databases for MongoDB
1+
# IBM Cloud Databases for MongoDB (Fully Configurable)
22

33
## Prerequisites
44
- An existing resource group

‎solutions/fully-configurable/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ variable "plan" {
7070
variable "service_endpoints" {
7171
type = string
7272
description = "The type of endpoint of the database instance. Possible values: `public`, `private`, `public-and-private`."
73-
default = "public"
73+
default = "private"
7474

7575
validation {
7676
condition = can(regex("public|public-and-private|private", var.service_endpoints))

‎solutions/security-enforced/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# IBM Cloud Databases for MongoDB (Security Enforced)
2+
3+
## Prerequisites
4+
- An existing resource group
5+
6+
This architecture creates an instance of IBM Cloud Databases for MongoDB and supports provisioning of the following resources:
7+
8+
- A KMS root key, if one is not passed in.
9+
- An IBM Cloud Databases for MongoDB instance with KMS encryption.
10+
- Autoscaling rules for the database instance, if provided.
11+
- Service credential secrets and store them in secret manager.
12+
13+
![fscloud-mongodb](../../reference-architecture/deployable-architecture-mongodb.svg)
14+
15+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).

‎solutions/security-enforced/catalogValidationValues.json.template‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"ibmcloud_api_key": $VALIDATION_APIKEY,
3+
"region": "us-south",
4+
"mongodb_tags": $TAGS,
5+
"mongodb_name": $PREFIX,
6+
"existing_resource_group_name": $PREFIX,
7+
"existing_kms_instance_crn": $HPCS_US_SOUTH_CRN
8+
}

‎solutions/security-enforced/main.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
module "mongodb" {
2+
source = "../fully-configurable"
3+
ibmcloud_api_key = var.ibmcloud_api_key
4+
existing_resource_group_name = var.existing_resource_group_name
5+
prefix = var.prefix
6+
mongodb_name = var.mongodb_name
7+
region = var.region
8+
mongodb_version = var.mongodb_version
9+
plan = var.plan
10+
service_endpoints = "private"
11+
existing_mongodb_instance_crn = var.existing_mongodb_instance_crn
12+
# ICD hosting model properties
13+
members = var.members
14+
memory_mb = var.memory_mb
15+
cpu_count = var.cpu_count
16+
disk_mb = var.disk_mb
17+
member_host_flavor = var.member_host_flavor
18+
service_credential_names = var.service_credential_names
19+
admin_pass = var.admin_pass
20+
users = var.users
21+
mongodb_tags = var.mongodb_tags
22+
mongodb_access_tags = var.mongodb_access_tags
23+
# Encryption
24+
kms_encryption_enabled = true
25+
use_ibm_owned_encryption_key = false
26+
existing_kms_instance_crn = var.existing_kms_instance_crn
27+
existing_kms_key_crn = var.existing_kms_key_crn
28+
existing_backup_kms_key_crn = var.existing_backup_kms_key_crn
29+
kms_endpoint_type = "private"
30+
skip_mongodb_kms_auth_policy = var.skip_mongodb_kms_auth_policy
31+
ibmcloud_kms_api_key = var.ibmcloud_kms_api_key
32+
key_ring_name = var.key_ring_name
33+
key_name = var.key_name
34+
use_default_backup_encryption_key = false
35+
backup_crn = var.backup_crn
36+
provider_visibility = "private"
37+
# Auto Scaling
38+
auto_scaling = var.auto_scaling
39+
# Secrets Manager Service Credentials
40+
existing_secrets_manager_instance_crn = var.existing_secrets_manager_instance_crn
41+
existing_secrets_manager_endpoint_type = "private"
42+
service_credential_secrets = var.service_credential_secrets
43+
skip_mongodb_secrets_manager_auth_policy = var.skip_mongodb_secrets_manager_auth_policy
44+
admin_pass_secrets_manager_secret_group = var.admin_pass_secrets_manager_secret_group
45+
use_existing_admin_pass_secrets_manager_secret_group = var.use_existing_admin_pass_secrets_manager_secret_group
46+
admin_pass_secrets_manager_secret_name = var.admin_pass_secrets_manager_secret_name
47+
}

0 commit comments

Comments
 (0)