Skip to content

Commit fc10af2

Browse files
Aashiq-JvburckhardtSirSpidey
authored
feat: Create submodules with defaults aligned with landing-zone workload and management VPCs (#442)
* feat: add landing zone submodule * fix: plain submodules * fix: pre-commit fixes * fix: enable flowlogs and add docs * fix: pre-commit fixes * fix: update the acl and use existing cos * test: add example and update test * fix: precommit fixes * fix: update the resource group name * fix: update docs and add tg * fix: bug in pr_test * fix: remove the extra resource groups * docs: make content more accurate * docs: make content more accurate * docs: make content more accurate * build: ignore false positive cra * Update examples/landing_zone/README.md Co-authored-by: Allen Dean <[email protected]> * Update examples/landing_zone/README.md Co-authored-by: Allen Dean <[email protected]> * Update landing-zone-submodule/workload-vpc/README.md Co-authored-by: Allen Dean <[email protected]> * Update landing-zone-submodule/management-vpc/README.md Co-authored-by: Allen Dean <[email protected]> * Update README.md Co-authored-by: Allen Dean <[email protected]> * Update examples/landing_zone/README.md Co-authored-by: Allen Dean <[email protected]> * build: fix pre-commit + add cra ignore --------- Co-authored-by: Vincent Burckhardt <[email protected]> Co-authored-by: Allen Dean <[email protected]>
1 parent 5351ab4 commit fc10af2

File tree

20 files changed

+1015
-7
lines changed

20 files changed

+1015
-7
lines changed

‎README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ This module creates the following IBM Cloud&reg; Virtual Private Cloud (VPC) net
1717

1818
![vpc-module](./.docs/vpc-module.png)
1919

20+
## Presets
21+
22+
In addition to this root module, this repository provides two submodules that call the root module with presets and defaults that are aligned with the general [Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-about) management and workload VPC topologies. See the [landing-zone-submodules](/landing-zone-submodule/) for details.
23+
24+
2025
## Usage
2126
```terraform
2227
module vpc {
@@ -62,6 +67,7 @@ You need the following permissions to run this module.
6267
## Examples
6368

6469
- [ Default Example](examples/default)
70+
- [ Landing Zone example](examples/landing_zone)
6571
<!-- END EXAMPLES HOOK -->
6672
---
6773

‎common-dev-assets‎

‎cra-tf-validate-ignore-goals.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@
3535
"description:": "Check whether Cloud Object Storage bucket resiliency is set to cross region",
3636
"ignore_reason": "This module does not create any Cloud object storage bucket and it is used in an example for testing purpose.",
3737
"is_valid": false
38+
},
39+
{
40+
"scc_goal_id": "3000451",
41+
"description:": "Check whether Virtual Private Cloud (VPC) network access control lists don't allow ingress from 0.0.0.0/0 to any port",
42+
"ignore_reason": "False positive introduced in CRA 1.2.1. There is no such allow ingress ACL created by the module. There is a deny rule on 0.0.0.0/0 to any port.",
43+
"is_valid": false
44+
},
45+
{
46+
"scc_goal_id": "3000452",
47+
"description:": "Check whether Virtual Private Cloud (VPC) network access control lists don't allow egress from 0.0.0.0/0 to any port",
48+
"ignore_reason": "False positive introduced in CRA 1.2.1. There is no such allow egress ACL created by the module. There is a deny rule on 0.0.0.0/0 to any port.",
49+
"is_valid": false
3850
}
3951
]
4052
}

‎examples/landing_zone/README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Landing Zone example
2+
3+
This example demonstrates how to use the management and workload VPC [modules](../../landing-zone-submodule/) to create a network VPC topology that is aligned with the network segregation key principles of the IBM Cloud [Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-vpc-architecture-connectivity-overview).
4+
5+
The example shows how to use the base modules to create the following topology:
6+
- A management VPC
7+
- A workload VPC
8+
- A transit gateway that connects the two VPCs
9+
10+
:exclamation: **Important:** The topology created in this example does not meet all compliance controls for the IBM Cloud Framework for Financial Services. Use the [terraform-ibm-landing-zone](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone) module to create a fully compliant stack.

‎examples/landing_zone/main.tf‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
##############################################################################
2+
# Resource Group
3+
##############################################################################
4+
5+
module "resource_group" {
6+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-resource-group.git?ref=v1.0.5"
7+
# if an existing resource group is not set (null) create a new one using prefix
8+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
9+
existing_resource_group_name = var.resource_group
10+
}
11+
12+
#############################################################################
13+
# Provision cloud object storage and bucket
14+
#############################################################################
15+
16+
module "cos_bucket" {
17+
count = var.enable_vpc_flow_logs ? 1 : 0
18+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-cos.git?ref=v6.0.0"
19+
resource_group_id = module.resource_group.resource_group_id
20+
region = var.region
21+
cross_region_location = null
22+
cos_instance_name = "${var.prefix}-vpc-logs-cos"
23+
cos_tags = var.resource_tags
24+
bucket_name = "${var.prefix}-vpc-logs-cos-bucket"
25+
encryption_enabled = false
26+
retention_enabled = false
27+
}
28+
29+
#############################################################################
30+
# Provision VPC
31+
#############################################################################
32+
33+
module "workload_vpc" {
34+
source = "../../landing-zone-submodule/workload-vpc/"
35+
resource_group_id = module.resource_group.resource_group_id
36+
region = var.region
37+
prefix = var.prefix
38+
tags = var.resource_tags
39+
enable_vpc_flow_logs = var.enable_vpc_flow_logs
40+
create_authorization_policy_vpc_to_cos = var.create_authorization_policy_vpc_to_cos
41+
existing_cos_instance_guid = module.cos_bucket[0].cos_instance_guid
42+
existing_cos_bucket_name = module.cos_bucket[0].bucket_name[0]
43+
}
44+
45+
46+
module "management_vpc" {
47+
source = "../../landing-zone-submodule/management-vpc/"
48+
resource_group_id = module.resource_group.resource_group_id
49+
region = var.region
50+
prefix = var.prefix
51+
tags = var.resource_tags
52+
}
53+
54+
55+
##############################################################################
56+
# Transit Gateway connects the 2 VPCs
57+
##############################################################################
58+
59+
module "tg_gateway_connection" {
60+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-transit-gateway.git?ref=v2.0.2"
61+
transit_gateway_name = "${var.prefix}-tg"
62+
region = var.region
63+
global_routing = false
64+
resource_tags = var.resource_tags
65+
resource_group_id = module.resource_group.resource_group_id
66+
vpc_connections = [module.workload_vpc.vpc_crn, module.management_vpc.vpc_crn]
67+
classic_connections_count = 0
68+
}

‎examples/landing_zone/outputs.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "workload_vpc_name" {
6+
description = "VPC name"
7+
value = module.workload_vpc.vpc_name
8+
}
9+
10+
output "workload_vpc_id" {
11+
description = "ID of VPC created"
12+
value = module.workload_vpc.vpc_id
13+
}
14+
15+
output "workload_vpc_crn" {
16+
description = "CRN of VPC created"
17+
value = module.workload_vpc.vpc_crn
18+
}
19+
20+
output "management_vpc_name" {
21+
description = "VPC name"
22+
value = module.management_vpc.vpc_name
23+
}
24+
25+
output "management_vpc_id" {
26+
description = "ID of VPC created"
27+
value = module.management_vpc.vpc_id
28+
}
29+
30+
output "management_vpc_crn" {
31+
description = "CRN of VPC created"
32+
value = module.management_vpc.vpc_crn
33+
}

‎examples/landing_zone/provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}

‎examples/landing_zone/variables.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
variable "ibmcloud_api_key" {
2+
description = "APIkey that's associated with the account to provision resources to"
3+
type = string
4+
sensitive = true
5+
}
6+
7+
variable "region" {
8+
description = "The region to which to deploy the VPC"
9+
type = string
10+
default = "us-south"
11+
}
12+
13+
variable "prefix" {
14+
description = "The prefix that you would like to append to your resources"
15+
type = string
16+
default = "test-landing-zone"
17+
}
18+
19+
variable "resource_group" {
20+
type = string
21+
description = "An existing resource group name to use for this example, if unset a new resource group will be created"
22+
default = null
23+
}
24+
25+
variable "resource_tags" {
26+
description = "List of Tags for the resource created"
27+
type = list(string)
28+
default = null
29+
}
30+
31+
32+
##############################################################################
33+
# VPC flow logs variables
34+
##############################################################################
35+
36+
variable "enable_vpc_flow_logs" {
37+
type = bool
38+
description = "Enable VPC Flow Logs, it will create Flow logs collector if set to true"
39+
default = true
40+
}
41+
42+
variable "create_authorization_policy_vpc_to_cos" {
43+
description = "Set it to true if authorization policy is required for VPC to access COS"
44+
type = bool
45+
default = true
46+
}

‎examples/landing_zone/version.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.3.0"
3+
required_providers {
4+
# Pin to the lowest provider version of the range defined in the main module's version.tf to ensure lowest version still works
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = "1.51.0"
8+
}
9+
}
10+
}

‎landing-zone-submodule/management-vpc/README.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Landing Zone management VPC (standalone)
2+
3+
This specialized submodule calls the root [landing-zone-vpc module](../..) with a preset configuration that results in a management VPC with a topology that is identical to the management VPC that is created by the [terraform-ibm-landing-zone module](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/tree/main).
4+
5+
You can use this submodule when you need more modularity to create your topology than the terraform-ibm-landing-zone module provides. This submodule provides one of the building blocks for this topology.
6+
7+
See the [Landing Zone example](../../examples/landing_zone/) for runnable code.
8+
9+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
10+
## Requirements
11+
12+
| Name | Version |
13+
|------|---------|
14+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
15+
16+
## Modules
17+
18+
| Name | Source | Version |
19+
|------|--------|---------|
20+
| <a name="module_management_vpc"></a> [management\_vpc](#module\_management\_vpc) | ../../ | n/a |
21+
22+
## Resources
23+
24+
No resources.
25+
26+
## Inputs
27+
28+
| Name | Description | Type | Default | Required |
29+
|------|-------------|------|---------|:--------:|
30+
| <a name="input_address_prefixes"></a> [address\_prefixes](#input\_address\_prefixes) | Use `address_prefixes` only if `use_manual_address_prefixes` is true otherwise prefixes will not be created. Use only if you need to manage prefixes manually. | <pre>object({<br> zone-1 = optional(list(string))<br> zone-2 = optional(list(string))<br> zone-3 = optional(list(string))<br> })</pre> | `null` | no |
31+
| <a name="input_classic_access"></a> [classic\_access](#input\_classic\_access) | Optionally allow VPC to access classic infrastructure network | `bool` | `null` | no |
32+
| <a name="input_create_authorization_policy_vpc_to_cos"></a> [create\_authorization\_policy\_vpc\_to\_cos](#input\_create\_authorization\_policy\_vpc\_to\_cos) | Set it to true if authorization policy is required for VPC to access COS | `bool` | `false` | no |
33+
| <a name="input_default_network_acl_name"></a> [default\_network\_acl\_name](#input\_default\_network\_acl\_name) | Override default ACL name | `string` | `null` | no |
34+
| <a name="input_default_routing_table_name"></a> [default\_routing\_table\_name](#input\_default\_routing\_table\_name) | Override default VPC routing table name | `string` | `null` | no |
35+
| <a name="input_default_security_group_name"></a> [default\_security\_group\_name](#input\_default\_security\_group\_name) | Override default VPC security group name | `string` | `null` | no |
36+
| <a name="input_default_security_group_rules"></a> [default\_security\_group\_rules](#input\_default\_security\_group\_rules) | Override default security group rules | <pre>list(<br> object({<br> name = string<br> direction = string<br> remote = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )</pre> | `[]` | no |
37+
| <a name="input_enable_vpc_flow_logs"></a> [enable\_vpc\_flow\_logs](#input\_enable\_vpc\_flow\_logs) | Enable VPC Flow Logs, it will create Flow logs collector if set to true | `bool` | `false` | no |
38+
| <a name="input_existing_cos_bucket_name"></a> [existing\_cos\_bucket\_name](#input\_existing\_cos\_bucket\_name) | Name of the COS bucket to collect VPC flow logs | `string` | `null` | no |
39+
| <a name="input_existing_cos_instance_guid"></a> [existing\_cos\_instance\_guid](#input\_existing\_cos\_instance\_guid) | GUID of the COS instance to create Flow log collector | `string` | `null` | no |
40+
| <a name="input_network_acls"></a> [network\_acls](#input\_network\_acls) | List of network ACLs to create with VPC | <pre>list(<br> object({<br> name = string<br> add_cluster_rules = optional(bool)<br> rules = list(<br> object({<br> name = string<br> action = string<br> destination = string<br> direction = string<br> source = string<br> tcp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> udp = optional(<br> object({<br> port_max = optional(number)<br> port_min = optional(number)<br> source_port_max = optional(number)<br> source_port_min = optional(number)<br> })<br> )<br> icmp = optional(<br> object({<br> type = optional(number)<br> code = optional(number)<br> })<br> )<br> })<br> )<br> })<br> )</pre> | <pre>[<br> {<br> "add_ibm_cloud_internal_rules": true,<br> "add_vpc_connectivity_rules": true,<br> "name": "management-acl",<br> "prepend_ibm_rules": true,<br> "rules": []<br> }<br>]</pre> | no |
41+
| <a name="input_network_cidr"></a> [network\_cidr](#input\_network\_cidr) | Network CIDR for the VPC. This is used to manage network ACL rules for cluster provisioning. | `string` | `"10.0.0.0/8"` | no |
42+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix that you would like to append to your resources | `string` | `"management"` | no |
43+
| <a name="input_region"></a> [region](#input\_region) | The region to which to deploy the VPC | `string` | `"au-syd"` | no |
44+
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where the VPC to be created | `string` | n/a | yes |
45+
| <a name="input_subnets"></a> [subnets](#input\_subnets) | Object for subnets to be created in each zone, each zone can have any number of subnets | <pre>object({<br> zone-1 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-2 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> zone-3 = list(object({<br> name = string<br> cidr = string<br> public_gateway = optional(bool)<br> acl_name = string<br> }))<br> })</pre> | <pre>{<br> "zone-1": [<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.10.10.0/24",<br> "name": "vsi-zone-1",<br> "public_gateway": false<br> },<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.10.20.0/24",<br> "name": "vpe-zone-1",<br> "public_gateway": false<br> },<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.10.30.0/24",<br> "name": "vpn-zone-1",<br> "public_gateway": false<br> }<br> ],<br> "zone-2": [<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.20.10.0/24",<br> "name": "vsi-zone-2",<br> "public_gateway": false<br> },<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.20.20.0/24",<br> "name": "vpe-zone-2",<br> "public_gateway": false<br> }<br> ],<br> "zone-3": [<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.30.10.0/24",<br> "name": "vsi-zone-3",<br> "public_gateway": false<br> },<br> {<br> "acl_name": "management-acl",<br> "cidr": "10.30.20.0/24",<br> "name": "vpe-zone-3",<br> "public_gateway": false<br> }<br> ]<br>}</pre> | no |
46+
| <a name="input_tags"></a> [tags](#input\_tags) | List of tags to apply to resources created by this module. | `list(string)` | `[]` | no |
47+
| <a name="input_use_manual_address_prefixes"></a> [use\_manual\_address\_prefixes](#input\_use\_manual\_address\_prefixes) | Optionally assign prefixes to VPC manually. By default this is false, and prefixes will be created along with subnets | `bool` | `true` | no |
48+
| <a name="input_use_public_gateways"></a> [use\_public\_gateways](#input\_use\_public\_gateways) | For each `zone` that is set to `true`, a public gateway will be created in that zone | <pre>object({<br> zone-1 = optional(bool)<br> zone-2 = optional(bool)<br> zone-3 = optional(bool)<br> })</pre> | <pre>{<br> "zone-1": false,<br> "zone-2": false,<br> "zone-3": false<br>}</pre> | no |
49+
50+
## Outputs
51+
52+
| Name | Description |
53+
|------|-------------|
54+
| <a name="output_vpc_crn"></a> [vpc\_crn](#output\_vpc\_crn) | CRN of VPC created |
55+
| <a name="output_vpc_id"></a> [vpc\_id](#output\_vpc\_id) | ID of VPC created |
56+
| <a name="output_vpc_name"></a> [vpc\_name](#output\_vpc\_name) | VPC name |
57+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)