Skip to content

Commit c80abaf

Browse files
whofflerwhoffler
committed
security enforced variation
1 parent 281fb97 commit c80abaf

File tree

11 files changed

+787
-6
lines changed

11 files changed

+787
-6
lines changed

‎ibm_catalog.json‎

Lines changed: 251 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,18 @@
9797
{
9898
"key": "ibmcloud_api_key"
9999
},
100+
{
101+
"key": "existing_resource_group_name",
102+
"required": true,
103+
"custom_config": {
104+
"type": "resource_group",
105+
"grouping": "deployment",
106+
"original_grouping": "deployment",
107+
"config_constraints": {
108+
"identifier": "rg_name"
109+
}
110+
}
111+
},
100112
{
101113
"key": "provider_visibility",
102114
"options": [
@@ -114,9 +126,6 @@
114126
}
115127
]
116128
},
117-
{
118-
"key": "existing_resource_group_name"
119-
},
120129
{
121130
"key": "prefix"
122131
},
@@ -259,7 +268,17 @@
259268
"key": "existing_kms_key_crn"
260269
},
261270
{
262-
"key": "kms_endpoint_type"
271+
"key": "kms_endpoint_type",
272+
"options": [
273+
{
274+
"displayname": "public",
275+
"value": "public"
276+
},
277+
{
278+
"displayname": "private",
279+
"value": "private"
280+
}
281+
]
263282
},
264283
{
265284
"key": "skip_mongodb_kms_auth_policy"
@@ -298,6 +317,234 @@
298317
"key": "skip_mongodb_secrets_manager_auth_policy"
299318
}
300319
]
320+
},
321+
{
322+
"label": "Security Enforced",
323+
"name": "security-enforced",
324+
"install_type": "fullstack",
325+
"working_directory": "solutions/security-enforced",
326+
"compliance": {
327+
"authority": "scc-v3",
328+
"profiles": [
329+
{
330+
"profile_name": "IBM Cloud Framework for Financial Services",
331+
"profile_version": "1.7.0"
332+
}
333+
]
334+
},
335+
"iam_permissions": [
336+
{
337+
"role_crns": [
338+
"crn:v1:bluemix:public:iam::::role:Editor"
339+
],
340+
"service_name": "databases-for-mongodb"
341+
},
342+
{
343+
"role_crns": [
344+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
345+
"crn:v1:bluemix:public:iam::::role:Editor"
346+
],
347+
"service_name": "kms"
348+
}
349+
],
350+
"architecture": {
351+
"descriptions": "This architecture creates an instance of IBM Cloud Databases for MongoDB instance with KMS encryption. Supports autoscaling.",
352+
"features": [
353+
{
354+
"title": " Creates an instance of Databases for MongoDB",
355+
"description": "This architecture creates an instance of IBM Cloud Databases for MongoDB with KMS encryption. It accepts or creates a resource group, and provides autoscaling rules."
356+
}
357+
],
358+
"diagrams": [
359+
{
360+
"diagram": {
361+
"caption": "Databases for MongoDB instance on IBM Cloud",
362+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-icd-mongodb/main/reference-architecture/deployable-architecture-mongodb.svg",
363+
"type": "image/svg+xml"
364+
},
365+
"description": "This architecture supports creating and configuring an instance of Databases for MongoDB instance with KMS encryption."
366+
}
367+
]
368+
},
369+
"configuration": [
370+
{
371+
"key": "ibmcloud_api_key"
372+
},
373+
{
374+
"key": "existing_resource_group_name",
375+
"required": true,
376+
"custom_config": {
377+
"type": "resource_group",
378+
"grouping": "deployment",
379+
"original_grouping": "deployment",
380+
"config_constraints": {
381+
"identifier": "rg_name"
382+
}
383+
}
384+
},
385+
{
386+
"key": "region",
387+
"required": true,
388+
"default_value": "us-south",
389+
"options": [
390+
{
391+
"displayname": "Chennai (che01)",
392+
"value": "che01"
393+
},
394+
{
395+
"displayname": "Dallas (us-south)",
396+
"value": "us-south"
397+
},
398+
{
399+
"displayname": "Frankfurt (eu-de)",
400+
"value": "eu-de"
401+
},
402+
{
403+
"displayname": "London (eu-gb)",
404+
"value": "eu-gb"
405+
},
406+
{
407+
"displayname": "Madrid (eu-es)",
408+
"value": "eu-es"
409+
},
410+
{
411+
"displayname": "Osaka (jp-osa)",
412+
"value": "jp-osa"
413+
},
414+
{
415+
"displayname": "Paris (par01)",
416+
"value": "par01"
417+
},
418+
{
419+
"displayname": "Sao Paulo (br-sao)",
420+
"value": "br-sao"
421+
},
422+
{
423+
"displayname": "Sydney (au-syd)",
424+
"value": "au-syd"
425+
},
426+
{
427+
"displayname": "Toronto (ca-tor)",
428+
"value": "ca-tor"
429+
},
430+
{
431+
"displayname": "Tokyo (jp-tok)",
432+
"value": "jp-tok"
433+
},
434+
{
435+
"displayname": "Washington (us-east)",
436+
"value": "us-east"
437+
}
438+
]
439+
},
440+
{
441+
"key": "prefix"
442+
},
443+
{
444+
"key": "mongodb_name"
445+
},
446+
447+
{
448+
"key": "mongodb_version",
449+
"required": false,
450+
"default_value": "__NULL__",
451+
"options": [
452+
{
453+
"displayname": "preferred",
454+
"value": "__NULL__"
455+
},
456+
{
457+
"displayname": "6.0",
458+
"value": "6.0"
459+
},
460+
{
461+
"displayname": "7.0",
462+
"value": "7.0"
463+
}
464+
]
465+
},
466+
{
467+
"key": "plan"
468+
},
469+
{
470+
"key": "members"
471+
},
472+
{
473+
"key": "memory_mb"
474+
},
475+
{
476+
"key": "cpu_count"
477+
},
478+
{
479+
"key": "disk_mb"
480+
},
481+
{
482+
"key": "member_host_flavor"
483+
},
484+
{
485+
"key": "service_credential_names"
486+
},
487+
{
488+
"key": "admin_pass"
489+
},
490+
{
491+
"key": "admin_pass_secrets_manager_secret_group"
492+
},
493+
{
494+
"key": "admin_pass_secrets_manager_secret_name"
495+
},
496+
{
497+
"key": "existing_mongodb_instance_crn"
498+
},
499+
{
500+
"key": "use_existing_admin_pass_secrets_manager_secret_group"
501+
},
502+
{
503+
"key": "users"
504+
},
505+
{
506+
"key": "mongodb_tags"
507+
},
508+
{
509+
"key": "mongodb_access_tags"
510+
},
511+
{
512+
"key": "existing_kms_instance_crn"
513+
},
514+
{
515+
"key": "existing_kms_key_crn"
516+
},
517+
{
518+
"key": "skip_mongodb_kms_auth_policy"
519+
},
520+
{
521+
"key": "ibmcloud_kms_api_key"
522+
},
523+
{
524+
"key": "key_ring_name"
525+
},
526+
{
527+
"key": "key_name"
528+
},
529+
{
530+
"key": "existing_backup_kms_key_crn"
531+
},
532+
{
533+
"key": "auto_scaling"
534+
},
535+
{
536+
"key": "backup_crn"
537+
},
538+
{
539+
"key": "existing_secrets_manager_instance_crn"
540+
},
541+
{
542+
"key": "service_credential_secrets"
543+
},
544+
{
545+
"key": "skip_mongodb_secrets_manager_auth_policy"
546+
}
547+
]
301548
}
302549
]
303550
}

‎solutions/fully-configurable/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# IBM Cloud Databases for MongoDB
1+
# IBM Cloud Databases for MongoDB (Fully Configurable)
22

33
## Prerequisites
44
- An existing resource group

‎solutions/fully-configurable/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ variable "plan" {
7070
variable "service_endpoints" {
7171
type = string
7272
description = "The type of endpoint of the database instance. Possible values: `public`, `private`, `public-and-private`."
73-
default = "public"
73+
default = "private"
7474

7575
validation {
7676
condition = can(regex("public|public-and-private|private", var.service_endpoints))

‎solutions/security-enforced/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# IBM Cloud Databases for MongoDB (Security Enforced)
2+
3+
## Prerequisites
4+
- An existing resource group
5+
6+
This architecture creates an instance of IBM Cloud Databases for MongoDB and supports provisioning of the following resources:
7+
8+
- A KMS root key, if one is not passed in.
9+
- An IBM Cloud Databases for MongoDB instance with KMS encryption.
10+
- Autoscaling rules for the database instance, if provided.
11+
- Service credential secrets and store them in secret manager.
12+
13+
![fscloud-mongodb](../../reference-architecture/deployable-architecture-mongodb.svg)
14+
15+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).

‎solutions/security-enforced/catalogValidationValues.json.template‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"ibmcloud_api_key": $VALIDATION_APIKEY,
3+
"region": "us-south",
4+
"mongodb_tags": $TAGS,
5+
"mongodb_name": $PREFIX,
6+
"existing_resource_group_name": $PREFIX,
7+
"existing_kms_instance_crn": $HPCS_US_SOUTH_CRN
8+
}

‎solutions/security-enforced/main.tf‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
module "mongodb" {
2+
source = "../fully-configurable"
3+
ibmcloud_api_key = var.ibmcloud_api_key
4+
existing_resource_group_name = var.existing_resource_group_name
5+
prefix = var.prefix
6+
mongodb_name = var.mongodb_name
7+
region = var.region
8+
mongodb_version = var.mongodb_version
9+
plan = var.plan
10+
service_endpoints = "private"
11+
existing_mongodb_instance_crn = var.existing_mongodb_instance_crn
12+
# ICD hosting model properties
13+
members = var.members
14+
memory_mb = var.memory_mb
15+
cpu_count = var.cpu_count
16+
disk_mb = var.disk_mb
17+
member_host_flavor = var.member_host_flavor
18+
service_credential_names = var.service_credential_names
19+
admin_pass = var.admin_pass
20+
users = var.users
21+
mongodb_tags = var.mongodb_tags
22+
mongodb_access_tags = var.mongodb_access_tags
23+
# Encryption
24+
kms_encryption_enabled = true
25+
use_ibm_owned_encryption_key = false
26+
existing_kms_instance_crn = var.existing_kms_instance_crn
27+
existing_kms_key_crn = var.existing_kms_key_crn
28+
existing_backup_kms_key_crn = var.existing_backup_kms_key_crn
29+
kms_endpoint_type = "private"
30+
skip_mongodb_kms_auth_policy = var.skip_mongodb_kms_auth_policy
31+
ibmcloud_kms_api_key = var.ibmcloud_kms_api_key
32+
key_ring_name = var.key_ring_name
33+
key_name = var.key_name
34+
use_default_backup_encryption_key = false
35+
backup_crn = var.backup_crn
36+
provider_visibility = "private"
37+
# Auto Scaling
38+
auto_scaling = var.auto_scaling
39+
# Secrets Manager Service Credentials
40+
existing_secrets_manager_instance_crn = var.existing_secrets_manager_instance_crn
41+
existing_secrets_manager_endpoint_type = "private"
42+
service_credential_secrets = var.service_credential_secrets
43+
skip_mongodb_secrets_manager_auth_policy = var.skip_mongodb_secrets_manager_auth_policy
44+
admin_pass_secrets_manager_secret_group = var.admin_pass_secrets_manager_secret_group
45+
use_existing_admin_pass_secrets_manager_secret_group = var.use_existing_admin_pass_secrets_manager_secret_group
46+
admin_pass_secrets_manager_secret_name = var.admin_pass_secrets_manager_secret_name
47+
}

0 commit comments

Comments
 (0)