feat: added the ability to scope attachments to a resource group using new input resource_groups_scope<br>* added the ability to set the attachment schedule using the new attachment_schedule input variable (#148)

Author: jor2

ibm_catalog.json

@@ -232,6 +232,30 @@
                         {
                           "key": "profile_attachments"
                         },
+                        {
+                          "key": "resource_groups_scope"
+                        },
+                        {
+                          "key": "attachment_schedule",
+                          "options": [
+                            {
+                              "displayname": "Daily",
+                              "value": "daily"
+                            },
+                            {
+                              "displayname": "Weekly",
+                              "value": "every_7_days"
+                            },
+                            {
+                              "displayname": "Monthly",
+                              "value": "every_30_days"
+                            },
+                            {
+                              "displayname": "Never",
+                              "value": "none"
+                            }
+                          ]
+                        },
                         {
                           "key": "provision_scc_workload_protection"
                         },

solutions/instances/README.md

@@ -39,13 +39,15 @@ This solution supports provisioning and configuring the following infrastructure
 | [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/resources/en_topic) | resource |
 | [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/en_destinations) | data source |
 | [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/iam_account_settings) | data source |
+| [ibm_resource_group.group](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/resource_group) | data source |
 | [ibm_resource_instance.scc_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/resource_instance) | data source |
 
 ### Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_add_bucket_name_suffix"></a> [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Whether to add a generated 4-character suffix to the created Security and Compliance Center Object Storage bucket name. Applies only if not specifying an existing bucket. Set to `false` not to add the suffix to the bucket name in the `scc_cos_bucket_name` variable. | `bool` | `true` | no |
+| <a name="input_attachment_schedule"></a> [attachment\_schedule](#input\_attachment\_schedule) | The scanning schedule. Possible values: `daily`, `every_7_days`, `every_30_days`, `none`. | `string` | `"daily"` | no |
 | <a name="input_cos_instance_access_tags"></a> [cos\_instance\_access\_tags](#input\_cos\_instance\_access\_tags) | A list of access tags to apply to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no |
 | <a name="input_cos_instance_name"></a> [cos\_instance\_name](#input\_cos\_instance\_name) | The name for the Object Storage instance. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-cos"` | no |
 | <a name="input_cos_instance_tags"></a> [cos\_instance\_tags](#input\_cos\_instance\_tags) | The list of tags to add to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no |
@@ -65,6 +67,7 @@ This solution supports provisioning and configuring the following infrastructure
 | <a name="input_profile_attachments"></a> [profile\_attachments](#input\_profile\_attachments) | The list of Security and Compliance Center profile attachments to create that are scoped to your IBM Cloud account. The attachment schedule runs daily and defaults to the latest version of the specified profile attachments. | `list(string)` | <pre>[<br>  "IBM Cloud Framework for Financial Services"<br>]</pre> | no |
 | <a name="input_provision_scc_workload_protection"></a> [provision\_scc\_workload\_protection](#input\_provision\_scc\_workload\_protection) | Whether to provision a Workload Protection instance. | `bool` | `true` | no |
 | <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of a new or an existing resource group in which to provision resources to. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | n/a | yes |
+| <a name="input_resource_groups_scope"></a> [resource\_groups\_scope](#input\_resource\_groups\_scope) | The resource group to associate with the Security and Compliance Center profile attachments. If not specified, the attachments are scoped to the current account ID. Only one resource group is allowed. | `list(string)` | `[]` | no |
 | <a name="input_scc_cos_bucket_access_tags"></a> [scc\_cos\_bucket\_access\_tags](#input\_scc\_cos\_bucket\_access\_tags) | The list of access tags to add to the Security and Compliance Center Object Storage bucket. | `list(string)` | `[]` | no |
 | <a name="input_scc_cos_bucket_class"></a> [scc\_cos\_bucket\_class](#input\_scc\_cos\_bucket\_class) | The storage class of the newly provisioned Security and Compliance Center Object Storage bucket. Possible values: `standard`, `vault`, `cold`, `smart`, `onerate_active`. [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-classes). | `string` | `"smart"` | no |
 | <a name="input_scc_cos_bucket_name"></a> [scc\_cos\_bucket\_name](#input\_scc\_cos\_bucket\_name) | The name for the Security and Compliance Center Object Storage bucket. Bucket names must globally unique. If `add_bucket_name_suffix` is true, a 4-character string is added to this name to  ensure it's globally unique. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-bucket"` | no |

solutions/instances/main.tf

@@ -171,6 +171,47 @@ module "scc" {
 # SCC Attachment
 #######################################################################################################################
 
+locals {
+  resource_group_supplied = length(var.resource_groups_scope) == 1
+}
+
+data "ibm_resource_group" "group" {
+  count = local.resource_group_supplied ? 1 : 0
+  name  = var.resource_groups_scope[0]
+}
+
+locals {
+  account_scope = {
+    environment = "ibm-cloud"
+    properties = [
+      {
+        name  = "scope_type"
+        value = "account"
+      },
+      {
+        name  = "scope_id"
+        value = data.ibm_iam_account_settings.iam_account_settings.account_id
+      },
+    ]
+  }
+
+  resource_group_scope = {
+    environment = "ibm-cloud"
+    properties = [
+      {
+        name  = "scope_type"
+        value = "account.resource_group"
+      },
+      {
+        name  = "scope_id"
+        value = local.resource_group_supplied ? data.ibm_resource_group.group[0].id : null
+      },
+    ]
+  }
+
+  scope = local.resource_group_supplied ? [local.account_scope, local.resource_group_scope] : [local.account_scope]
+}
+
 # Data source to account settings
 data "ibm_iam_account_settings" "iam_account_settings" {}
 
@@ -186,22 +227,8 @@ module "create_profile_attachment" {
   scc_instance_id        = local.scc_instance_guid
   attachment_name        = "${each.value + 1} daily full account attachment"
   attachment_description = "SCC profile attachment scoped to your specific IBM Cloud account id ${data.ibm_iam_account_settings.iam_account_settings.account_id} with a daily attachment schedule."
-  attachment_schedule    = "daily"
-  scope = [
-    {
-      environment = "ibm-cloud"
-      properties = [
-        {
-          name  = "scope_type"
-          value = "account"
-        },
-        {
-          name  = "scope_id"
-          value = data.ibm_iam_account_settings.iam_account_settings.account_id
-        },
-      ]
-    }
-  ]
+  attachment_schedule    = var.attachment_schedule
+  scope                  = local.scope
 }
 
 #######################################################################################################################

solutions/instances/variables.tf

@@ -226,6 +226,27 @@ variable "profile_attachments" {
   default     = ["IBM Cloud Framework for Financial Services"]
 }
 
+variable "resource_groups_scope" {
+  type        = list(string)
+  description = "The resource group to associate with the Security and Compliance Center profile attachments. If not specified, the attachments are scoped to the current account ID. Only one resource group is allowed."
+  default     = []
+  validation {
+    condition     = length(var.resource_groups_scope) <= 1
+    error_message = "Only one resource group is allowed."
+  }
+}
+
+variable "attachment_schedule" {
+  type        = string
+  description = "The scanning schedule. Possible values: `daily`, `every_7_days`, `every_30_days`, `none`."
+  default     = "daily"
+
+  validation {
+    condition     = contains(["daily", "every_7_days", "every_30_days", "none"], var.attachment_schedule)
+    error_message = "You can set the schedule only to `daily`, `every_7_days`, `every_30_days`, or `none`."
+  }
+}
+
 ########################################################################################################################
 # SCC Workload Protection variables
 ########################################################################################################################