Skip to content
This repository was archived by the owner on Mar 19, 2025. It is now read-only.

Commit 727b24c

Browse files
kierramariekierramarie
authored
fix: refactor to consume latest SCC module version (#170)
1 parent 3dbae5a commit 727b24c

File tree

3 files changed

+23
-35
lines changed

3 files changed

+23
-35
lines changed

‎solutions/instances/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,6 @@ This solution supports provisioning and configuring the following infrastructure
4242
| [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.69.2/docs/data-sources/en_destinations) | data source |
4343
| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.69.2/docs/data-sources/iam_account_settings) | data source |
4444
| [ibm_resource_group.group](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.69.2/docs/data-sources/resource_group) | data source |
45-
| [ibm_resource_instance.scc_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.69.2/docs/data-sources/resource_instance) | data source |
4645

4746
### Inputs
4847

‎solutions/instances/main.tf‎

Lines changed: 13 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ module "kms" {
4545
providers = {
4646
ibm = ibm.kms
4747
}
48-
count = var.existing_scc_cos_kms_key_crn != null || var.existing_scc_cos_bucket_name != null ? 0 : 1 # no need to create any KMS resources if passing an existing key, or bucket
48+
count = (var.existing_scc_cos_kms_key_crn != null || var.existing_scc_cos_bucket_name != null) && var.existing_scc_instance_crn == null ? 0 : 1 # no need to create any KMS resources if passing an existing key or bucket, or SCC instance
4949
source = "terraform-ibm-modules/kms-all-inclusive/ibm"
5050
version = "4.15.13"
5151
create_key_protect_instance = false
@@ -86,7 +86,7 @@ module "cos" {
8686
providers = {
8787
ibm = ibm.cos
8888
}
89-
count = var.existing_scc_cos_bucket_name == null ? 1 : 0 # no need to call COS module if consumer is passing existing COS bucket
89+
count = var.existing_scc_cos_bucket_name == null && var.existing_scc_instance_crn == null ? 1 : 0 # no need to call COS module if consumer is passing existing SCC instance or COS bucket
9090
source = "terraform-ibm-modules/cos/ibm//modules/fscloud"
9191
version = "8.11.11"
9292
resource_group_id = module.resource_group.resource_group_id
@@ -127,31 +127,20 @@ module "cos" {
127127
#######################################################################################################################
128128
# SCC Instance
129129
#######################################################################################################################
130-
131130
locals {
132131
parsed_existing_scc_instance_crn = var.existing_scc_instance_crn != null ? split(":", var.existing_scc_instance_crn) : []
133-
existing_scc_instance_guid = length(local.parsed_existing_scc_instance_crn) > 0 ? local.parsed_existing_scc_instance_crn[7] : null
134132
existing_scc_instance_region = length(local.parsed_existing_scc_instance_crn) > 0 ? local.parsed_existing_scc_instance_crn[5] : null
135-
136-
scc_instance_crn = var.existing_scc_instance_crn == null ? module.scc[0].crn : var.existing_scc_instance_crn
137-
scc_instance_guid = var.existing_scc_instance_crn == null ? module.scc[0].guid : local.existing_scc_instance_guid
138-
scc_instance_region = var.existing_scc_instance_crn == null ? var.scc_region : local.existing_scc_instance_region
139-
133+
scc_instance_region = var.existing_scc_instance_crn == null ? var.scc_region : local.existing_scc_instance_region
140134
}
141135

142136
moved {
143-
from = module.scc
144-
to = module.scc[0]
145-
}
146-
147-
data "ibm_resource_instance" "scc_instance" {
148-
count = var.existing_scc_instance_crn == null ? 0 : 1
149-
identifier = local.scc_instance_guid
137+
from = module.scc[0]
138+
to = module.scc
150139
}
151140

152141
module "scc" {
153-
count = var.existing_scc_instance_crn == null ? 1 : 0
154142
source = "terraform-ibm-modules/scc/ibm"
143+
existing_scc_instance_crn = var.existing_scc_instance_crn
155144
version = "1.8.9"
156145
resource_group_id = module.resource_group.resource_group_id
157146
region = local.scc_instance_region
@@ -162,8 +151,8 @@ module "scc" {
162151
en_instance_crn = var.existing_en_crn
163152
skip_cos_iam_authorization_policy = var.skip_scc_cos_auth_policy
164153
resource_tags = var.scc_instance_tags
165-
attach_wp_to_scc_instance = var.provision_scc_workload_protection
166-
wp_instance_crn = var.provision_scc_workload_protection ? module.scc_wp[0].crn : null
154+
attach_wp_to_scc_instance = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null
155+
wp_instance_crn = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].crn : null
167156
skip_scc_wp_auth_policy = var.skip_scc_workload_protection_auth_policy
168157
}
169158

@@ -224,7 +213,7 @@ module "create_profile_attachment" {
224213
}
225214
profile_name = each.key
226215
profile_version = "latest"
227-
scc_instance_id = local.scc_instance_guid
216+
scc_instance_id = module.scc.guid
228217
attachment_name = "${each.value + 1} daily full account attachment"
229218
attachment_description = "SCC profile attachment scoped to your specific IBM Cloud account id ${data.ibm_iam_account_settings.iam_account_settings.account_id} with a daily attachment schedule."
230219
attachment_schedule = var.attachment_schedule
@@ -236,7 +225,7 @@ module "create_profile_attachment" {
236225
#######################################################################################################################
237226

238227
module "scc_wp" {
239-
count = var.provision_scc_workload_protection ? 1 : 0
228+
count = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? 1 : 0
240229
source = "terraform-ibm-modules/scc-workload-protection/ibm"
241230
version = "1.3.1"
242231
name = local.scc_workload_protection_instance_name
@@ -274,13 +263,13 @@ resource "time_sleep" "wait_for_scc" {
274263
}
275264

276265
resource "ibm_en_topic" "en_topic" {
277-
count = var.existing_en_crn != null ? 1 : 0
266+
count = var.existing_en_crn != null && var.existing_scc_instance_crn == null ? 1 : 0
278267
depends_on = [time_sleep.wait_for_scc]
279268
instance_guid = local.existing_en_guid
280269
name = local.en_topic
281270
description = "Topic for SCC events routing"
282271
sources {
283-
id = local.scc_instance_crn
272+
id = module.scc.crn
284273
rules {
285274
enabled = true
286275
event_type_filter = "$.*"
@@ -289,7 +278,7 @@ resource "ibm_en_topic" "en_topic" {
289278
}
290279

291280
resource "ibm_en_subscription_email" "email_subscription" {
292-
count = var.existing_en_crn != null && length(var.scc_en_email_list) > 0 ? 1 : 0
281+
count = var.existing_en_crn != null && var.existing_scc_instance_crn == null && length(var.scc_en_email_list) > 0 ? 1 : 0
293282
instance_guid = local.existing_en_guid
294283
name = local.en_subscription_email
295284
description = "Subscription for Security and Compliance Center Events"

‎solutions/instances/outputs.tf‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -14,53 +14,53 @@ output "resource_group_id" {
1414

1515
output "scc_id" {
1616
description = "SCC instance ID"
17-
value = var.existing_scc_instance_crn == null ? module.scc[0].id : var.existing_scc_instance_crn
17+
value = module.scc.id
1818
}
1919

2020
output "scc_guid" {
2121
description = "SCC instance guid"
22-
value = var.existing_scc_instance_crn == null ? module.scc[0].guid : local.existing_scc_instance_guid
22+
value = module.scc.guid
2323
}
2424

2525
output "scc_crn" {
2626
description = "SCC instance CRN"
27-
value = var.existing_scc_instance_crn == null ? module.scc[0].crn : var.existing_scc_instance_crn
27+
value = module.scc.crn
2828
}
2929

3030
output "scc_name" {
3131
description = "SCC instance name"
32-
value = var.existing_scc_instance_crn == null ? module.scc[0].name : data.ibm_resource_instance.scc_instance[0].name
32+
value = module.scc.name
3333
}
3434

3535
output "scc_workload_protection_id" {
3636
description = "SCC Workload Protection instance ID"
37-
value = var.provision_scc_workload_protection ? module.scc_wp[0].id : null
37+
value = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].id : null
3838
}
3939

4040
output "scc_workload_protection_crn" {
4141
description = "SCC Workload Protection instance CRN"
42-
value = var.provision_scc_workload_protection ? module.scc_wp[0].crn : null
42+
value = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].crn : null
4343
}
4444

4545
output "scc_workload_protection_name" {
4646
description = "SCC Workload Protection instance name"
47-
value = var.provision_scc_workload_protection ? module.scc_wp[0].name : null
47+
value = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].name : null
4848
}
4949

5050
output "scc_workload_protection_ingestion_endpoint" {
5151
description = "SCC Workload Protection instance ingestion endpoint"
52-
value = var.provision_scc_workload_protection ? module.scc_wp[0].name : null
52+
value = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].name : null
5353
}
5454

5555
output "scc_workload_protection_api_endpoint" {
5656
description = "SCC Workload Protection API endpoint"
57-
value = var.provision_scc_workload_protection ? module.scc_wp[0].api_endpoint : null
57+
value = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].api_endpoint : null
5858
sensitive = true
5959
}
6060

6161
output "scc_workload_protection_access_key" {
6262
description = "SCC Workload Protection access key"
63-
value = var.provision_scc_workload_protection ? module.scc_wp[0].access_key : null
63+
value = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null ? module.scc_wp[0].access_key : null
6464
sensitive = true
6565
}
6666

0 commit comments

Comments
 (0)