add: fully-configurable & security-enforced version

README.md

@@ -122,6 +122,7 @@ To attach access management tags to resources in this module, you need the follo
 | <a name="input_configuration"></a> [configuration](#input\_configuration) | Database configuration parameters, see https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-changing-configuration&interface=api for more details. | <pre>object({<br/>    default_authentication_plugin      = optional(string) # sha256_password,caching_sha2_password,mysql_native_password<br/>    innodb_buffer_pool_size_percentage = optional(number) # 10 ≤ value ≤ 100<br/>    innodb_flush_log_at_trx_commit     = optional(number) # 0 ≤ value ≤ 2<br/>    innodb_log_buffer_size             = optional(number) # 1048576 ≤ value ≤ 4294967295<br/>    innodb_log_file_size               = optional(number) # 4194304 ≤ value ≤ 274877906900<br/>    innodb_lru_scan_depth              = optional(number) # 128 ≤ value ≤ 2048<br/>    innodb_read_io_threads             = optional(number) # 1 ≤ value ≤ 64<br/>    innodb_write_io_threads            = optional(number) # 1 ≤ value ≤ 64<br/>    max_allowed_packet                 = optional(number) # 1024 ≤ value ≤ 1073741824<br/>    max_connections                    = optional(number) # 100 ≤ value ≤ 200000<br/>    max_prepared_stmt_count            = optional(number) # 0 ≤ value ≤ 4194304<br/>    mysql_max_binlog_age_sec           = optional(number) # 300 ≤ value ≤ 1073741823 Default: 1800<br/>    net_read_timeout                   = optional(number) # 1 ≤ value ≤ 7200<br/>    net_write_timeout                  = optional(number) # 1 ≤ value ≤ 7200<br/>    sql_mode                           = optional(string) # The comma-separated list of SQL modes applied on this server globally<br/>    wait_timeout                       = optional(number) # 1 ≤ value ≤ 31536000<br/>  })</pre> | `null` | no |
 | <a name="input_cpu_count"></a> [cpu\_count](#input\_cpu\_count) | Allocated dedicated CPU per member. For shared CPU, set to 0. [Learn more](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-resources-scaling) | `number` | `0` | no |
 | <a name="input_disk_mb"></a> [disk\_mb](#input\_disk\_mb) | Allocated disk per member. [Learn more](https://cloud.ibm.com/docs/databases-for-mysql?topic=databases-for-mysql-resources-scaling) | `number` | `10240` | no |
+| <a name="input_kms_encryption_enabled"></a> [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set to true to enable KMS Encryption | `bool` | `true` | no |
 | <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. Applies only if `use_ibm_owned_encryption_key` is false. By default this key is used for both deployment data and backups, but this behaviour can be altered using the `use_same_kms_key_for_backups` and `backup_encryption_key_crn` inputs. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups). | `string` | `null` | no |
 | <a name="input_member_host_flavor"></a> [member\_host\_flavor](#input\_member\_host\_flavor) | Allocated host flavor per member. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/database#host_flavor). | `string` | `null` | no |
 | <a name="input_members"></a> [members](#input\_members) | Allocated number of members. Members can be scaled up but not down. | `number` | `3` | no |

main.tf

@@ -7,7 +7,7 @@ locals {
   # tflint-ignore: terraform_unused_declarations
   validate_kms_values = var.use_ibm_owned_encryption_key && (var.kms_key_crn != null || var.backup_encryption_key_crn != null) ? tobool("When passing values for 'kms_key_crn' or 'backup_encryption_key_crn', you must set 'use_ibm_owned_encryption_key' to false. Otherwise unset them to use default encryption.") : true
   # tflint-ignore: terraform_unused_declarations
-  validate_kms_vars = !var.use_ibm_owned_encryption_key && var.kms_key_crn == null ? tobool("When setting 'use_ibm_owned_encryption_key' to false, a value must be passed for 'kms_key_crn'.") : true
+  validate_kms_vars = !var.use_ibm_owned_encryption_key && var.kms_encryption_enabled && var.kms_key_crn == null ? tobool("When setting 'use_ibm_owned_encryption_key' to false, 'kms_encryption_enabled' must be set to true and a value must be passed for 'kms_key_crn'.") : true
   # tflint-ignore: terraform_unused_declarations
   validate_backup_key = !var.use_ibm_owned_encryption_key && var.backup_encryption_key_crn != null && (var.use_default_backup_encryption_key || var.use_same_kms_key_for_backups) ? tobool("When passing a value for 'backup_encryption_key_crn' you cannot set 'use_default_backup_encryption_key' to true or 'use_ibm_owned_encryption_key' to false.") : true
   # tflint-ignore: terraform_unused_declarations
@@ -34,8 +34,8 @@ locals {
 ########################################################################################################################
 
 locals {
-  parse_kms_key        = !var.use_ibm_owned_encryption_key
-  parse_backup_kms_key = !var.use_ibm_owned_encryption_key && !var.use_default_backup_encryption_key
+  parse_kms_key        = !var.use_ibm_owned_encryption_key && var.kms_encryption_enabled
+  parse_backup_kms_key = !var.use_ibm_owned_encryption_key && !var.use_default_backup_encryption_key && var.kms_encryption_enabled
 }
 
 module "kms_key_crn_parser" {
@@ -69,10 +69,10 @@ locals {
 ########################################################################################################################
 
 locals {
-  # only create auth policy if 'use_ibm_owned_encryption_key' is false, and 'skip_iam_authorization_policy' is false
-  create_kms_auth_policy = !var.use_ibm_owned_encryption_key && !var.skip_iam_authorization_policy ? 1 : 0
-  # only create backup auth policy if 'use_ibm_owned_encryption_key' is false, 'skip_iam_authorization_policy' is false and 'use_same_kms_key_for_backups' is false
-  create_backup_kms_auth_policy = !var.use_ibm_owned_encryption_key && !var.skip_iam_authorization_policy && !var.use_same_kms_key_for_backups ? 1 : 0
+  # only create auth policy if 'use_ibm_owned_encryption_key' is false, and 'skip_iam_authorization_policy' is false and 'kms_encryption_enabled' is true
+  create_kms_auth_policy = !var.use_ibm_owned_encryption_key && var.kms_encryption_enabled && !var.skip_iam_authorization_policy ? 1 : 0
+  # only create backup auth policy if 'use_ibm_owned_encryption_key' is false, 'skip_iam_authorization_policy' is false and 'use_same_kms_key_for_backups' is false and 'kms_encryption_enabled' is true
+  create_backup_kms_auth_policy = !var.use_ibm_owned_encryption_key && var.kms_encryption_enabled && !var.skip_iam_authorization_policy && !var.use_same_kms_key_for_backups ? 1 : 0
 }
 
 # Create IAM Authorization Policies to allow MySQL to access KMS for the encryption key