Skip to content
This repository was archived by the owner on Mar 19, 2025. It is now read-only.

Commit 968b30c

Browse files
authored
feat: Add outputs for the DA solution<br>* Updated to COS module 7.5.3 to pull in fix for bug which occurs when passing existing COS instance<br>* Added some extra logic to validate variable vaules (#24)
1 parent 5ad4b63 commit 968b30c

File tree

11 files changed

+420
-4
lines changed

11 files changed

+420
-4
lines changed

solutions/instances/README.md

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,90 @@ This solution supports the following:
77
- Provisioning and configuring of a Security and Compliance Center Workload Protection instance.
88

99
**NB:** This solution is not intended to be called by one or more other modules since it contains a provider configurations, meaning it is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers)
10+
11+
### Current limitation
12+
Currently this solution does not support attaching the Workload Protection instance to the SCC instance. That enhancement is being tracked in https://github.com/terraform-ibm-modules/terraform-ibm-scc-da/issues/23
13+
14+
<!-- Below content is automatically populated via pre-commit hook -->
15+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
16+
### Requirements
17+
18+
| Name | Version |
19+
|------|---------|
20+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0, <1.7.0 |
21+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.63.0 |
22+
23+
### Modules
24+
25+
| Name | Source | Version |
26+
|------|--------|---------|
27+
| <a name="module_cos"></a> [cos](#module\_cos) | terraform-ibm-modules/cos/ibm//modules/fscloud | 7.5.3 |
28+
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 4.8.4 |
29+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.1.5 |
30+
| <a name="module_scc"></a> [scc](#module\_scc) | terraform-ibm-modules/scc/ibm | 1.2.0 |
31+
| <a name="module_scc_wp"></a> [scc\_wp](#module\_scc\_wp) | terraform-ibm-modules/scc-workload-protection/ibm | 1.2.1 |
32+
33+
### Resources
34+
35+
No resources.
36+
37+
### Inputs
38+
39+
| Name | Description | Type | Default | Required |
40+
|------|-------------|------|---------|:--------:|
41+
| <a name="input_add_bucket_name_suffix"></a> [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Add random generated suffix (4 characters long) to the newly provisioned SCC COS bucket name. Only used if not passing existing bucket. set to false if you want full control over bucket naming using the 'scc\_cos\_bucket\_name' variable. | `bool` | `true` | no |
42+
| <a name="input_cos_instance_access_tags"></a> [cos\_instance\_access\_tags](#input\_cos\_instance\_access\_tags) | A list of access tags to apply to the Cloud Object Storage instance. Only used if not supplying an existing instance. | `list(string)` | `[]` | no |
43+
| <a name="input_cos_instance_name"></a> [cos\_instance\_name](#input\_cos\_instance\_name) | The name to use when creating the Cloud Object Storage instance. | `string` | `"base-security-services-cos"` | no |
44+
| <a name="input_cos_instance_tags"></a> [cos\_instance\_tags](#input\_cos\_instance\_tags) | Optional list of tags to be added to Cloud Object Storage instance. Only used if not supplying an existing instance. | `list(string)` | `[]` | no |
45+
| <a name="input_cos_region"></a> [cos\_region](#input\_cos\_region) | The Cloud Object Storage region. | `string` | `"us-south"` | no |
46+
| <a name="input_existing_activity_tracker_crn"></a> [existing\_activity\_tracker\_crn](#input\_existing\_activity\_tracker\_crn) | (Optional) The CRN of an existing Activity Tracker instance. Used to send SCC COS bucket log data and all object write events to Activity Tracker. Only used if not supplying an existing COS bucket. | `string` | `null` | no |
47+
| <a name="input_existing_cos_instance_crn"></a> [existing\_cos\_instance\_crn](#input\_existing\_cos\_instance\_crn) | The CRN of an existing Cloud Object Storage instance. If not supplied, a new instance will be created. | `string` | `null` | no |
48+
| <a name="input_existing_en_crn"></a> [existing\_en\_crn](#input\_existing\_en\_crn) | (Optional) The CRN of an existing Event Notification instance. Used to integrate with SCC. | `string` | `null` | no |
49+
| <a name="input_existing_kms_guid"></a> [existing\_kms\_guid](#input\_existing\_kms\_guid) | The GUID of of the KMS instance used for the SCC COS bucket root Key. Only required if not supplying an existing KMS root key and if 'skip\_cos\_kms\_auth\_policy' is true. | `string` | `null` | no |
50+
| <a name="input_existing_monitoring_crn"></a> [existing\_monitoring\_crn](#input\_existing\_monitoring\_crn) | (Optional) The CRN of an existing IBM Cloud Monitoring instance. Used to send all COS bucket request and usage metrics to, as well as SCC workload protection data. Ignored if using existing COS bucket and not provisioning SCC workload protection. | `string` | `null` | no |
51+
| <a name="input_existing_resource_group"></a> [existing\_resource\_group](#input\_existing\_resource\_group) | Whether to use an existing resource group. | `bool` | `false` | no |
52+
| <a name="input_existing_scc_cos_bucket_name"></a> [existing\_scc\_cos\_bucket\_name](#input\_existing\_scc\_cos\_bucket\_name) | The name of an existing bucket inside the existing Cloud Object Storage instance to use for SCC. If not supplied, a new bucket will be created. | `string` | `null` | no |
53+
| <a name="input_existing_scc_cos_kms_key_crn"></a> [existing\_scc\_cos\_kms\_key\_crn](#input\_existing\_scc\_cos\_kms\_key\_crn) | The CRN of an existing KMS key to be used to encrypt the SCC COS bucket. If not supplied, a new key ring and key will be created in the provided KMS instance. | `string` | `null` | no |
54+
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The API Key to use for IBM Cloud. | `string` | n/a | yes |
55+
| <a name="input_kms_endpoint_type"></a> [kms\_endpoint\_type](#input\_kms\_endpoint\_type) | The type of endpoint to be used for commincating with the KMS instance. Allowed values are: 'public' or 'private' (default) | `string` | `"private"` | no |
56+
| <a name="input_kms_region"></a> [kms\_region](#input\_kms\_region) | The region in which KMS instance exists. | `string` | `"us-south"` | no |
57+
| <a name="input_management_endpoint_type_for_bucket"></a> [management\_endpoint\_type\_for\_bucket](#input\_management\_endpoint\_type\_for\_bucket) | The type of endpoint for the IBM terraform provider to use to manage COS buckets. (`public`, `private` or `direct`). Ensure to enable virtual routing and forwarding (VRF) in your account if using `private`, and that the terraform runtime has access to the the IBM Cloud private network. | `string` | `"private"` | no |
58+
| <a name="input_provision_scc_workload_protection"></a> [provision\_scc\_workload\_protection](#input\_provision\_scc\_workload\_protection) | Whether to provision an SCC Workload Protection instance. | `bool` | `true` | no |
59+
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of a new or an existing resource group in which to provision resources to. | `string` | n/a | yes |
60+
| <a name="input_scc_cos_bucket_access_tags"></a> [scc\_cos\_bucket\_access\_tags](#input\_scc\_cos\_bucket\_access\_tags) | Optional list of access tags to be added to the SCC COS bucket. | `list(string)` | `[]` | no |
61+
| <a name="input_scc_cos_bucket_class"></a> [scc\_cos\_bucket\_class](#input\_scc\_cos\_bucket\_class) | The storage class of the newly provisioned SCC COS bucket. Allowed values are: 'standard', 'vault', 'cold', 'smart' (default value), 'onerate\_active' | `string` | `"smart"` | no |
62+
| <a name="input_scc_cos_bucket_name"></a> [scc\_cos\_bucket\_name](#input\_scc\_cos\_bucket\_name) | The name to use when creating the SCC Cloud Object Storage bucket (NOTE: bucket names are globally unique). If 'add\_bucket\_name\_suffix' is set to true, a random 4 characters will be added to this name to help ensure bucket name is globally unique. | `string` | `"base-security-services-bucket"` | no |
63+
| <a name="input_scc_cos_key_name"></a> [scc\_cos\_key\_name](#input\_scc\_cos\_key\_name) | The name to give the Key which will be created for the SCC COS bucket. Not used if supplying an existing Key. | `string` | `"scc-cos-key"` | no |
64+
| <a name="input_scc_cos_key_ring_name"></a> [scc\_cos\_key\_ring\_name](#input\_scc\_cos\_key\_ring\_name) | The name to give the Key Ring which will be created for the SCC COS bucket Key. Not used if supplying an existing Key. | `string` | `"scc-cos-key-ring"` | no |
65+
| <a name="input_scc_instance_name"></a> [scc\_instance\_name](#input\_scc\_instance\_name) | The name to give the SCC instance that will be provisioned by this solution. | `string` | `"base-security-services-scc"` | no |
66+
| <a name="input_scc_instance_tags"></a> [scc\_instance\_tags](#input\_scc\_instance\_tags) | Optional list of tags to be added to SCC instance. | `list(string)` | `[]` | no |
67+
| <a name="input_scc_region"></a> [scc\_region](#input\_scc\_region) | The region in which to provision SCC resources. | `string` | `"us-south"` | no |
68+
| <a name="input_scc_service_plan"></a> [scc\_service\_plan](#input\_scc\_service\_plan) | The service/pricing plan to use when provisioning a new Security Compliance Center instance. Allowed values are: 'security-compliance-center-standard-plan' (default value) and 'security-compliance-center-trial-plan'. Only used if `provision_scc_instance` is set to true. | `string` | `"security-compliance-center-standard-plan"` | no |
69+
| <a name="input_scc_wp_access_tags"></a> [scc\_wp\_access\_tags](#input\_scc\_wp\_access\_tags) | A list of access tags to apply to the SCC WP instance. | `list(string)` | `[]` | no |
70+
| <a name="input_scc_wp_instance_name"></a> [scc\_wp\_instance\_name](#input\_scc\_wp\_instance\_name) | The name to give the SCC Workload Protection instance that will be provisioned by this solution. Must begine with a letter. Only used i 'provision\_scc\_workload\_protection' to true. | `string` | `"base-security-services-scc-wp"` | no |
71+
| <a name="input_scc_wp_instance_tags"></a> [scc\_wp\_instance\_tags](#input\_scc\_wp\_instance\_tags) | Optional list of tags to be added to SCC Workload Protection instance. | `list(string)` | `[]` | no |
72+
| <a name="input_scc_wp_resource_key_name"></a> [scc\_wp\_resource\_key\_name](#input\_scc\_wp\_resource\_key\_name) | The name to give the IBM Cloud SCC Workload Protection manager resource key. | `string` | `"SCCWPManagerKey"` | no |
73+
| <a name="input_scc_wp_resource_key_tags"></a> [scc\_wp\_resource\_key\_tags](#input\_scc\_wp\_resource\_key\_tags) | Tags associated with the IBM Cloud SCC WP resource key. | `list(string)` | `[]` | no |
74+
| <a name="input_scc_wp_service_plan"></a> [scc\_wp\_service\_plan](#input\_scc\_wp\_service\_plan) | SCC Workload Protection instance service pricing plan. Allowed values are: `free-trial` or `graduated-tier`. | `string` | `"graduated-tier"` | no |
75+
| <a name="input_skip_cos_kms_auth_policy"></a> [skip\_cos\_kms\_auth\_policy](#input\_skip\_cos\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the COS instance created to read the encryption key from the KMS instance. WARNING: An authorization policy must exist before an encrypted bucket can be created | `bool` | `false` | no |
76+
| <a name="input_skip_scc_cos_auth_policy"></a> [skip\_scc\_cos\_auth\_policy](#input\_skip\_scc\_cos\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the SCC instance created by this solution write access to the COS instance. Only used if `provision_scc_instance` is set to true. | `bool` | `false` | no |
77+
78+
### Outputs
79+
80+
| Name | Description |
81+
|------|-------------|
82+
| <a name="output_resource_group_id"></a> [resource\_group\_id](#output\_resource\_group\_id) | Resource group ID |
83+
| <a name="output_resource_group_name"></a> [resource\_group\_name](#output\_resource\_group\_name) | Resource group name |
84+
| <a name="output_scc_cos_bucket_name"></a> [scc\_cos\_bucket\_name](#output\_scc\_cos\_bucket\_name) | SCC COS bucket name |
85+
| <a name="output_scc_cos_kms_key_crn"></a> [scc\_cos\_kms\_key\_crn](#output\_scc\_cos\_kms\_key\_crn) | SCC COS KMS Key CRN |
86+
| <a name="output_scc_crn"></a> [scc\_crn](#output\_scc\_crn) | SCC instance CRN |
87+
| <a name="output_scc_guid"></a> [scc\_guid](#output\_scc\_guid) | SCC instance guid |
88+
| <a name="output_scc_id"></a> [scc\_id](#output\_scc\_id) | SCC instance ID |
89+
| <a name="output_scc_name"></a> [scc\_name](#output\_scc\_name) | SCC instance name |
90+
| <a name="output_scc_wp_access_key"></a> [scc\_wp\_access\_key](#output\_scc\_wp\_access\_key) | SCC Workload Protection access key |
91+
| <a name="output_scc_wp_api_endpoint"></a> [scc\_wp\_api\_endpoint](#output\_scc\_wp\_api\_endpoint) | SCC Workload Protection API endpoint |
92+
| <a name="output_scc_wp_crn"></a> [scc\_wp\_crn](#output\_scc\_wp\_crn) | SCC Workload Protection instance CRN |
93+
| <a name="output_scc_wp_id"></a> [scc\_wp\_id](#output\_scc\_wp\_id) | SCC Workload Protection instance ID |
94+
| <a name="output_scc_wp_ingestion_endpoint"></a> [scc\_wp\_ingestion\_endpoint](#output\_scc\_wp\_ingestion\_endpoint) | SCC Workload Protection instance ingestion endpoint |
95+
| <a name="output_scc_wp_name"></a> [scc\_wp\_name](#output\_scc\_wp\_name) | SCC Workload Protection instance name |
96+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

solutions/instances/main.tf

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,14 @@
22
# Validation
33
#######################################################################################################################
44

5-
# TODO: Add some variable validation - https://github.com/terraform-ibm-modules/terraform-ibm-scc-da/issues/6
5+
locals {
6+
# tflint-ignore: terraform_unused_declarations
7+
validate_inputs = var.existing_scc_cos_bucket_name == null && var.existing_scc_cos_kms_key_crn == null && var.existing_kms_guid == null ? tobool("A value must be passed for 'existing_kms_guid' if not supplying any value for 'existing_scc_cos_kms_key_crn' or 'existing_scc_cos_bucket_name'.") : true
8+
# tflint-ignore: terraform_unused_declarations
9+
validate_cos_inputs = var.existing_scc_cos_bucket_name != null && var.existing_scc_cos_kms_key_crn != null ? tobool("A value should not be passed for 'existing_scc_cos_kms_key_crn' when passing a value for 'existing_scc_cos_bucket_name'. A key is only needed when creating a new COS bucket.") : true
10+
# tflint-ignore: terraform_unused_declarations
11+
validate_auth_inputs = !var.skip_scc_cos_auth_policy && var.existing_cos_instance_crn == null && var.existing_scc_cos_bucket_name != null ? tobool("A value must be passed for 'existing_cos_instance_crn' in order to create auth policy.") : true
12+
}
613

714
#######################################################################################################################
815
# Resource Group
@@ -78,7 +85,7 @@ module "cos" {
7885
}
7986
count = var.existing_scc_cos_bucket_name == null ? 1 : 0 # no need to call COS module if consumer is passing existing COS bucket
8087
source = "terraform-ibm-modules/cos/ibm//modules/fscloud"
81-
version = "7.5.1"
88+
version = "7.5.3"
8289
resource_group_id = module.resource_group.resource_group_id
8390
create_cos_instance = var.existing_cos_instance_crn == null ? true : false # don't create instance if existing one passed in
8491
create_resource_key = false

solutions/instances/outputs.tf

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,76 @@
11
########################################################################################################################
22
# Outputs
33
########################################################################################################################
4+
5+
output "resource_group_name" {
6+
description = "Resource group name"
7+
value = module.resource_group.resource_group_name
8+
}
9+
10+
output "resource_group_id" {
11+
description = "Resource group ID"
12+
value = module.resource_group.resource_group_id
13+
}
14+
15+
output "scc_cos_kms_key_crn" {
16+
description = "SCC COS KMS Key CRN"
17+
# if passing an existing bucket, then no KMS key is in play here, so output will be null
18+
value = var.existing_scc_cos_bucket_name != null ? null : local.scc_cos_kms_key_crn
19+
}
20+
21+
output "scc_cos_bucket_name" {
22+
description = "SCC COS bucket name"
23+
value = local.cos_bucket_name
24+
}
25+
26+
output "scc_id" {
27+
description = "SCC instance ID"
28+
value = module.scc.id
29+
}
30+
31+
output "scc_guid" {
32+
description = "SCC instance guid"
33+
value = module.scc.guid
34+
}
35+
36+
output "scc_crn" {
37+
description = "SCC instance CRN"
38+
value = module.scc.crn
39+
}
40+
41+
output "scc_name" {
42+
description = "SCC instance name"
43+
value = module.scc.name
44+
}
45+
46+
output "scc_wp_id" {
47+
description = "SCC Workload Protection instance ID"
48+
value = var.provision_scc_workload_protection ? module.scc_wp[0].id : null
49+
}
50+
51+
output "scc_wp_crn" {
52+
description = "SCC Workload Protection instance CRN"
53+
value = var.provision_scc_workload_protection ? module.scc_wp[0].crn : null
54+
}
55+
56+
output "scc_wp_name" {
57+
description = "SCC Workload Protection instance name"
58+
value = var.provision_scc_workload_protection ? module.scc_wp[0].name : null
59+
}
60+
61+
output "scc_wp_ingestion_endpoint" {
62+
description = "SCC Workload Protection instance ingestion endpoint"
63+
value = var.provision_scc_workload_protection ? module.scc_wp[0].name : null
64+
}
65+
66+
output "scc_wp_api_endpoint" {
67+
description = "SCC Workload Protection API endpoint"
68+
value = var.provision_scc_workload_protection ? module.scc_wp[0].api_endpoint : null
69+
sensitive = true
70+
}
71+
72+
output "scc_wp_access_key" {
73+
description = "SCC Workload Protection access key"
74+
value = var.provision_scc_workload_protection ? module.scc_wp[0].access_key : null
75+
sensitive = true
76+
}

tests/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ go 1.21
55
toolchain go1.21.3
66

77
require (
8+
github.com/gruntwork-io/terratest v0.46.11
89
github.com/stretchr/testify v1.9.0
910
github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.29.8
1011
)
@@ -62,7 +63,6 @@ require (
6263
github.com/google/uuid v1.6.0 // indirect
6364
github.com/googleapis/enterprise-certificate-proxy v0.2.4 // indirect
6465
github.com/googleapis/gax-go/v2 v2.11.0 // indirect
65-
github.com/gruntwork-io/terratest v0.46.11 // indirect
6666
github.com/hashicorp/errwrap v1.1.0 // indirect
6767
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
6868
github.com/hashicorp/go-getter v1.7.1 // indirect

0 commit comments

Comments
 (0)