Skip to content

Commit affc8fb

Browse files
MatthewLemmondMatthewLemmond
authored
feat: initial module implementation (#4)
1 parent 1770363 commit affc8fb

19 files changed

+578
-116
lines changed

‎README.md‎

Lines changed: 51 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,18 @@
11
<!-- Update the title -->
2-
# Terraform Modules Template Project
2+
# Terraform IBM S2S Auth
33

44
<!--
55
Update status and "latest release" badges:
66
1. For the status options, see https://github.ibm.com/GoldenEye/documentation/blob/master/status.md
77
2. Update the "latest release" badge to point to the correct module's repo. Replace "module-template" in two places.
88
-->
9-
[![Incubating (Not yet consumable)](https://img.shields.io/badge/status-Incubating%20(Not%20yet%20consumable)-red)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
9+
[![Stable (Adopted)](https://img.shields.io/badge/Status-Stable%20(Adopted)-yellowgreen?style=plastic)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
1010
[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-s2s-auth?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-s2s-auth/releases/latest)
1111
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
1212
[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)
1313
[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
1414

15-
<!-- Add a description of module(s) in this repo -->
16-
TODO: Replace me with description of the module(s) in this repo
17-
15+
This module is responsible for generating authorization policies and CBR rules that enable access permissions and restrictions between a source service and a target service
1816

1917
<!-- Below content is automatically populated via pre-commit hook -->
2018
<!-- BEGIN OVERVIEW HOOK -->
@@ -49,38 +47,42 @@ unless real values don't help users know what to change.
4947
-->
5048

5149
```hcl
52-
50+
module "service_auth_cbr_rules" {
51+
# Replace "main" with a GIT release version to lock into a specific release
52+
source = "terraform-ibm-modules/s2s-auth/ibm"
53+
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
54+
service_map = [
55+
{
56+
"description"= "This is a test auth policy",
57+
"enforcement_mode"= "report",
58+
"roles"= [
59+
"Reader"
60+
],
61+
"source_resource_instance_id"= "<source_resource_instance_id>",
62+
"source_service_name"= "cloud-object-storage",
63+
"target_resource_instance_id"= "<target_resource_instance_id>",
64+
"target_service_name"= "kms"
65+
},
66+
{
67+
"description"= "This is a test auth policy",
68+
"enforcement_mode"= "report",
69+
"roles"= [
70+
"Reader"
71+
],
72+
"source_rg"= "<source_rg>",
73+
"source_service_name"= "containers-kubernetes",
74+
"target_rg"= "<target_rg>",
75+
"target_service_name"= "kms"
76+
}
77+
]
78+
}
5379
```
5480

5581
### Required IAM access policies
5682

57-
<!-- PERMISSIONS REQUIRED TO RUN MODULE
58-
If this module requires permissions, uncomment the following block and update
59-
the sample permissions, following the format.
60-
Replace the sample Account and IBM Cloud service names and roles with the
61-
information in the console at
62-
Manage > Access (IAM) > Access groups > Access policies.
63-
-->
64-
65-
<!--
6683
You need the following permissions to run this module.
6784

68-
- Account Management
69-
- **Sample Account Service** service
70-
- `Editor` platform access
71-
- `Manager` service access
72-
- IAM Services
73-
- **Sample Cloud Service** service
74-
- `Administrator` platform access
75-
-->
76-
77-
<!-- NO PERMISSIONS FOR MODULE
78-
If no permissions are required for the module, uncomment the following
79-
statement instead the previous block.
80-
-->
81-
82-
<!-- No permissions are needed to run this module.-->
83-
85+
* You must have access to the target service to create an authorization between services. You can grant only the level of access that you have as a user of the target service. For example, if you have viewer access on the target service, you can assign only the viewer role for the authorization.
8486

8587
<!-- Below content is automatically populated via pre-commit hook -->
8688
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
@@ -89,22 +91,36 @@ statement instead the previous block.
8991
| Name | Version |
9092
|------|---------|
9193
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0, <1.6.0 |
94+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.56.1 |
9295

9396
### Modules
9497

95-
No modules.
98+
| Name | Source | Version |
99+
|------|--------|---------|
100+
| <a name="module_cbr_rules"></a> [cbr\_rules](#module\_cbr\_rules) | terraform-ibm-modules/cbr/ibm//modules/cbr-service-profile | 1.12.1 |
96101

97102
### Resources
98103

99-
No resources.
104+
| Name | Type |
105+
|------|------|
106+
| [ibm_iam_authorization_policy.auth_policies](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
100107

101108
### Inputs
102109

103-
No inputs.
110+
| Name | Description | Type | Default | Required |
111+
|------|-------------|------|---------|:--------:|
112+
| <a name="input_cbr_target_service_details"></a> [cbr\_target\_service\_details](#input\_cbr\_target\_service\_details) | Details of the target service for which the rule has to be created | <pre>list(object({<br> target_service_name = string<br> target_rg = optional(string)<br> enforcement_mode = string<br> tags = optional(list(string))<br> }))</pre> | `[]` | no |
113+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix to append when creating CBR zones and CBR rules | `string` | `null` | no |
114+
| <a name="input_service_map"></a> [service\_map](#input\_service\_map) | Map of source service and the corresponding target service details | <pre>list(object({<br> source_service_name = string<br> target_service_name = string<br> roles = list(string)<br> description = optional(string, null)<br> source_resource_instance_id = optional(string, null)<br> target_resource_instance_id = optional(string, null)<br> source_resource_group_id = optional(string, null)<br> target_resource_group_id = optional(string, null)<br> }))</pre> | `[]` | no |
115+
| <a name="input_zone_service_ref_list"></a> [zone\_service\_ref\_list](#input\_zone\_service\_ref\_list) | Service reference for the zone creation | `list(string)` | `[]` | no |
116+
| <a name="input_zone_vpc_crn_list"></a> [zone\_vpc\_crn\_list](#input\_zone\_vpc\_crn\_list) | VPC CRN for the zones | `list(string)` | `[]` | no |
104117

105118
### Outputs
106119

107-
No outputs.
120+
| Name | Description |
121+
|------|-------------|
122+
| <a name="output_auth_policies"></a> [auth\_policies](#output\_auth\_policies) | Authorizations created |
123+
| <a name="output_cbr_rules"></a> [cbr\_rules](#output\_cbr\_rules) | CBR Rules created |
108124
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
109125

110126
<!-- Leave this section as is so that your module has a link to local development environment set up steps for contributors to follow -->

‎cra-tf-validate-ignore-rules.json‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,16 @@
11
{
2-
"scc_rules": []
2+
"scc_rules": [
3+
{
4+
"scc_rule_id": "rule-8cbd597c-7471-42bd-9c88-36b2696456e9",
5+
"description": "Check whether Cloud Object Storage network access is restricted to a specific IP range",
6+
"ignore_reason": "This rule is not relevant to the module itself, just the COS resource that is used in the example that is scanned",
7+
"is_valid": false
8+
},
9+
{
10+
"scc_rule_id": "rule-c97259ee-336d-4c5f-b436-1868107a9558",
11+
"description": "Check whether Cloud Object Storage is enabled with customer-managed encryption and Keep Your Own Key (KYOK)",
12+
"ignore_reason": "This rule is not relevant to the module itself, just the COS resource that is used in the example that is scanned",
13+
"is_valid": false
14+
}
15+
]
316
}

‎examples/basic/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,7 @@ The text below should describe exactly what resources are provisioned / configur
77
-->
88

99
An end-to-end basic example that will provision the following:
10+
1011
- A new resource group if one is not passed in.
11-
- A new Cloud Object Storage instance.
12+
- An authorization policy for databases-for-postgresql -> kms.
13+
- A cbr rule for kms in the resource group.

‎examples/basic/main.tf‎

Lines changed: 27 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,33 @@ module "resource_group" {
1111
}
1212

1313
########################################################################################################################
14-
# COS instance
14+
# S2S Auth Module
1515
########################################################################################################################
1616

17-
resource "ibm_resource_instance" "cos_instance" {
18-
name = "${var.prefix}-cos"
19-
resource_group_id = module.resource_group.resource_group_id
20-
service = "cloud-object-storage"
21-
plan = "standard"
22-
location = "global"
23-
tags = var.resource_tags
17+
locals {
18+
# generate a service_map
19+
service_map = [{
20+
source_service_name = "databases-for-postgresql"
21+
target_service_name = "kms"
22+
roles = ["Reader"]
23+
description = "This is a test policy"
24+
source_resource_instance_id = null
25+
target_resource_instance_id = null
26+
source_resource_group_id = module.resource_group.resource_group_id
27+
target_resource_group_id = module.resource_group.resource_group_id
28+
}
29+
]
30+
cbr_target_service_details = [{
31+
target_service_name = "kms"
32+
target_rg = module.resource_group.resource_group_id
33+
enforcement_mode = "report"
34+
}]
35+
}
36+
37+
module "service_auth_cbr_rules" {
38+
source = "../.."
39+
service_map = local.service_map
40+
cbr_target_service_details = local.cbr_target_service_details
41+
prefix = var.prefix
42+
zone_service_ref_list = ["databases-for-postgresql"]
2443
}

‎examples/basic/outputs.tf‎

Lines changed: 3 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,7 @@
22
# Outputs
33
########################################################################################################################
44

5-
output "cos_instance_id" {
6-
description = "COS instance id"
7-
value = ibm_resource_instance.cos_instance.id
8-
}
9-
10-
output "resource_group_name" {
11-
description = "Resource group name"
12-
value = module.resource_group.resource_group_name
13-
}
14-
15-
output "resource_group_id" {
16-
description = "Resource group ID"
17-
value = module.resource_group.resource_group_id
5+
output "service_auth_cbr_rules" {
6+
description = "Details of rules created"
7+
value = module.service_auth_cbr_rules
188
}

‎examples/basic/variables.tf‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,17 +17,11 @@ variable "region" {
1717
variable "prefix" {
1818
type = string
1919
description = "Prefix to append to all resources created by this example"
20-
default = "basic"
20+
default = "basic-s2s"
2121
}
2222

2323
variable "resource_group" {
2424
type = string
2525
description = "The name of an existing resource group to provision resources in to. If not set a new resource group will be created using the prefix variable"
2626
default = null
2727
}
28-
29-
variable "resource_tags" {
30-
type = list(string)
31-
description = "Optional list of tags to be added to created resources"
32-
default = []
33-
}

‎examples/basic/version.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ terraform {
66
required_providers {
77
ibm = {
88
source = "IBM-Cloud/ibm"
9-
version = "1.49.0"
9+
version = "1.56.1"
1010
}
1111
}
1212
}

‎examples/complete/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,11 @@
22

33
<!-- There is a pre-commit hook that will take the title of each example add include it in the repos main README.md -->
44
<!-- Add text below should describe exactly what resources are provisioned / configured by the example -->
5+
6+
An example that creates authentication policies and context based restrictions
7+
8+
This example uses the IBM Cloud terraform provider to:
9+
10+
- Create resource groups if not provided
11+
- Create a Cloud Object Storage and Key protect instance instance
12+
- Create auth policies and CBR rules for the newly created services

‎examples/complete/main.tf‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,95 @@
11
##############################################################################
22
# Complete example
33
##############################################################################
4+
5+
##############################################################################
6+
# Resource Group
7+
##############################################################################
8+
9+
module "resource_group" {
10+
source = "terraform-ibm-modules/resource-group/ibm"
11+
version = "1.1.0"
12+
# if an existing resource group is not set (null) create a new one using prefix
13+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
14+
existing_resource_group_name = var.resource_group
15+
}
16+
17+
# Create COS instance
18+
module "cos_instance" {
19+
source = "terraform-ibm-modules/cos/ibm"
20+
version = "6.12.2"
21+
cos_instance_name = "${var.prefix}-cos"
22+
kms_encryption_enabled = false
23+
retention_enabled = false
24+
resource_group_id = module.resource_group.resource_group_id
25+
bucket_name = "${var.prefix}-cos-bucket"
26+
}
27+
28+
# Create Key Protect instance
29+
module "key_protect_instance" {
30+
source = "terraform-ibm-modules/key-protect/ibm"
31+
version = "2.3.1"
32+
key_protect_name = "${var.prefix}-key-protect"
33+
resource_group_id = module.resource_group.resource_group_id
34+
plan = "tiered-pricing"
35+
region = var.region
36+
tags = var.resource_tags
37+
}
38+
39+
resource "ibm_is_vpc" "vpc_instance" {
40+
name = "${var.prefix}-vpc"
41+
resource_group = module.resource_group.resource_group_id
42+
tags = var.resource_tags
43+
}
44+
45+
# generate a service_map
46+
locals {
47+
service_map = [
48+
{
49+
source_service_name = "cloud-object-storage"
50+
target_service_name = "kms"
51+
roles = ["Reader"]
52+
description = "This is a test policy"
53+
source_resource_instance_id = module.cos_instance.cos_instance_id
54+
target_resource_instance_id = module.key_protect_instance.key_protect_guid
55+
source_resource_group_id = null
56+
target_resource_group_id = null
57+
},
58+
{
59+
source_service_name = "cloud-object-storage"
60+
target_service_name = "kms"
61+
roles = ["Reader"]
62+
description = "This is a test policy"
63+
source_resource_instance_id = null
64+
target_resource_instance_id = module.key_protect_instance.key_protect_guid
65+
source_resource_group_id = module.resource_group.resource_group_id
66+
target_resource_group_id = null
67+
},
68+
{
69+
source_service_name = "cloud-object-storage"
70+
target_service_name = "kms"
71+
roles = ["Reader"]
72+
description = "This is a test policy"
73+
source_resource_instance_id = module.cos_instance.cos_instance_id
74+
target_resource_instance_id = null
75+
source_resource_group_id = null
76+
target_resource_group_id = module.resource_group.resource_group_id
77+
}
78+
]
79+
cbr_target_service_details = [
80+
{
81+
target_service_name = "kms"
82+
target_rg = module.resource_group.resource_group_id
83+
enforcement_mode = var.enforcement_mode
84+
}
85+
]
86+
}
87+
88+
module "service_auth_cbr_rules" {
89+
source = "../.."
90+
service_map = local.service_map
91+
cbr_target_service_details = local.cbr_target_service_details
92+
prefix = var.prefix
93+
zone_vpc_crn_list = [ibm_is_vpc.vpc_instance.crn]
94+
zone_service_ref_list = ["cloud-object-storage"]
95+
}

‎examples/complete/outputs.tf‎

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,17 @@
22
# Outputs
33
##############################################################################
44

5-
output "region" {
6-
description = "The region all resources were provisioned in"
7-
value = var.region
5+
output "cos_instance" {
6+
description = "COS instance"
7+
value = module.resource_group.resource_group_id
88
}
99

10-
output "prefix" {
11-
description = "The prefix used to name all provisioned resources"
12-
value = var.prefix
10+
output "key_protect_instance_guid" {
11+
description = "Key protect instance"
12+
value = module.key_protect_instance.key_protect_guid
1313
}
1414

15-
output "resource_group_name" {
16-
description = "The name of the resource group used"
17-
value = var.resource_group
18-
}
19-
20-
output "resource_tags" {
21-
description = "List of resource tags"
22-
value = var.resource_tags
15+
output "service_auth_cbr_rules" {
16+
description = "Details of rules created"
17+
value = module.service_auth_cbr_rules
2318
}

0 commit comments

Comments
 (0)