Skip to content

Commit 0c11711

Browse files
jor2jor2
authored
feat: added a DA to IBM catalog (#181)
1 parent 9d4852f commit 0c11711

File tree

17 files changed

+713
-32
lines changed

17 files changed

+713
-32
lines changed

‎.catalog-onboard-pipeline.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
apiVersion: v1
3+
offerings:
4+
- name: deploy-arch-ibm-scc-workload-protection
5+
kind: solution
6+
catalog_id: 7df1e4ca-d54c-4fd0-82ce-3d13247308cd
7+
offering_id: 4322cf44-2289-49aa-a719-dd79e39b14dc
8+
variations:
9+
- name: fully-configurable
10+
mark_ready: true
11+
install_type: fullstack
12+
scc:
13+
instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
14+
region: us-south

‎.releaserc‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,9 @@
1010
}],
1111
["@semantic-release/exec", {
1212
"successCmd": "echo \"SEMVER_VERSION=${nextRelease.version}\" >> $GITHUB_ENV"
13+
}],
14+
["@semantic-release/exec", {
15+
"publishCmd": "./ci/trigger-catalog-onboarding-pipeline.sh --version=v${nextRelease.version}"
1316
}]
1417
]
1518
}

‎README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
<!-- Add a description of module(s) in this repo -->
1111
A module for provisioning an [IBM Cloud Security and Compliance Center Workload Protection instance](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-getting-started). The module will always create a Manager resource key that connects to the SCC WP instance.
1212

13-
1413
<!-- Below content is automatically populated via pre-commit hook -->
1514
<!-- BEGIN OVERVIEW HOOK -->
1615
## Overview

‎ibm_catalog.json‎

Lines changed: 198 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,198 @@
1+
{
2+
"products": [
3+
{
4+
"name": "deploy-arch-ibm-scc-workload-protection",
5+
"label": "Cloud automation for Security and Compliance Center Workload Protection",
6+
"product_kind": "solution",
7+
"tags": [
8+
"ibm_created",
9+
"target_terraform",
10+
"terraform",
11+
"solution",
12+
"security"
13+
],
14+
"keywords": [
15+
"SCC",
16+
"security",
17+
"compliance",
18+
"workload-protection",
19+
"IaC",
20+
"infrastructure as code",
21+
"terraform",
22+
"solution"
23+
],
24+
"short_description": "Creates and configures IBM Security and Compliance Center Workload Protection resources",
25+
"long_description": "This architecture supports creating and configuring IBM Security and Compliance Center Workload Protection resources.",
26+
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/blob/main/solutions/instances/README.md",
27+
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/main/images/scc-icon.svg",
28+
"provider_name": "IBM",
29+
"features": [
30+
{
31+
"title": "Security and Compliance Center Workload Protection",
32+
"description": "Creates and configures a Security and Compliance Center Workload Protection instance."
33+
}
34+
],
35+
"support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/issues](https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/issues). Please note this product is not supported via the IBM Cloud Support Center.",
36+
"flavors": [
37+
{
38+
"label": "Fully configurable",
39+
"name": "fully-configurable",
40+
"working_directory": "solutions/fully-configurable",
41+
"install_type": "fullstack",
42+
"compliance": {
43+
"authority": "scc-v3",
44+
"profiles": [
45+
{
46+
"profile_name": "IBM Cloud Framework for Financial Services",
47+
"profile_version": "1.7.0"
48+
}
49+
]
50+
},
51+
"configuration": [
52+
{
53+
"key": "ibmcloud_api_key",
54+
"required": true
55+
},
56+
{
57+
"key": "existing_resource_group_name",
58+
"required": true
59+
},
60+
{
61+
"key": "prefix",
62+
"required": true,
63+
"description": "The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To not use any prefix value, you can enter the string `__NULL__`."
64+
},
65+
{
66+
"key": "region",
67+
"required": true,
68+
"options": [
69+
{
70+
"value": "us-south"
71+
},
72+
{
73+
"value": "eu-de"
74+
},
75+
{
76+
"value": "eu-gb"
77+
},
78+
{
79+
"value": "eu-es"
80+
},
81+
{
82+
"value": "jp-osa"
83+
},
84+
{
85+
"value": "br-sao"
86+
},
87+
{
88+
"value": "au-syd"
89+
},
90+
{
91+
"value": "jp-tok"
92+
},
93+
{
94+
"value": "ca-tor"
95+
},
96+
{
97+
"value": "us-east"
98+
}
99+
]
100+
},
101+
{
102+
"key": "provider_visibility",
103+
"options": [
104+
{
105+
"value": "private"
106+
},
107+
{
108+
"value": "public"
109+
},
110+
{
111+
"value": "public-and-private"
112+
}
113+
]
114+
},
115+
{
116+
"key": "existing_monitoring_crn"
117+
},
118+
{
119+
"key": "scc_workload_protection_instance_name"
120+
},
121+
{
122+
"key": "scc_workload_protection_service_plan",
123+
"options": [
124+
{
125+
"value": "free-trial"
126+
},
127+
{
128+
"value": "graduated-tier"
129+
}
130+
]
131+
},
132+
{
133+
"key": "scc_workload_protection_instance_tags",
134+
"custom_config": {
135+
"grouping": "deployment",
136+
"original_grouping": "deployment",
137+
"config_constraints": {
138+
"type": "string"
139+
}
140+
}
141+
},
142+
{
143+
"key": "scc_workload_protection_resource_key_tags",
144+
"custom_config": {
145+
"grouping": "deployment",
146+
"original_grouping": "deployment",
147+
"config_constraints": {
148+
"type": "string"
149+
}
150+
}
151+
},
152+
{
153+
"key": "scc_workload_protection_access_tags",
154+
"custom_config": {
155+
"grouping": "deployment",
156+
"original_grouping": "deployment",
157+
"config_constraints": {
158+
"type": "string"
159+
}
160+
}
161+
},
162+
{
163+
"key": "cbr_rules"
164+
}
165+
],
166+
"iam_permissions": [
167+
{
168+
"service_name": "sysdig-secure",
169+
"role_crns": [
170+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
171+
"crn:v1:bluemix:public:iam::::role:Editor"
172+
]
173+
}
174+
],
175+
"architecture": {
176+
"descriptions": "This architecture supports creating and configuring a Security and Compliance Center Workload Protection instance.",
177+
"features": [
178+
{
179+
"title": "Creates a Security and Compliance Center Workload Protection instance",
180+
"description": "Creates and configures a Security and Compliance Center Workload Protection instance."
181+
}
182+
],
183+
"diagrams": [
184+
{
185+
"diagram": {
186+
"caption": "Security and Compliance Center Workload Protection",
187+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/main/reference-architecture/scc.svg",
188+
"type": "image/svg+xml"
189+
},
190+
"description": "This architecture supports creating and configuring IBM Security and Compliance Center Workload Protection resources"
191+
}
192+
]
193+
}
194+
}
195+
]
196+
}
197+
]
198+
}

‎images/scc-icon.svg‎

Lines changed: 1 addition & 0 deletions
Loading

‎reference-architecture/scc.svg‎

Lines changed: 4 additions & 0 deletions
Loading

‎solutions/fully-configurable/README.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Cloud automation for Security and Compliance Center Workload Protection
2+
3+
This solution supports provisioning and configuring the following infrastructure:
4+
5+
- A Security and Compliance Center Workload Protection instance.
6+
7+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).
8+
9+
![Workload Protection](./reference-architecture/scc.svg)
10+
11+
<!-- Below content is automatically populated via pre-commit hook -->
12+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
13+
### Requirements
14+
15+
| Name | Version |
16+
|------|---------|
17+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
18+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.75.2 |
19+
20+
### Modules
21+
22+
| Name | Source | Version |
23+
|------|--------|---------|
24+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.1.6 |
25+
| <a name="module_scc_wp"></a> [scc\_wp](#module\_scc\_wp) | ../.. | n/a |
26+
27+
### Resources
28+
29+
No resources.
30+
31+
### Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
|------|-------------|------|---------|:--------:|
35+
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | The list of context-based restriction rules to create for the instance.[Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection/blob/main/solutions/fully-configurable/cbr-rules.md) | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
36+
| <a name="input_existing_monitoring_crn"></a> [existing\_monitoring\_crn](#input\_existing\_monitoring\_crn) | The CRN of an IBM Cloud Monitoring instance to to send Workload Protection data. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. | `string` | `null` | no |
37+
| <a name="input_existing_resource_group_name"></a> [existing\_resource\_group\_name](#input\_existing\_resource\_group\_name) | The name of a an existing resource group in which to provision resources to. | `string` | `"Default"` | no |
38+
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key to deploy resources. | `string` | n/a | yes |
39+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix to add to all resources that this solution creates (e.g `prod`, `test`, `dev`). To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes |
40+
| <a name="input_provider_visibility"></a> [provider\_visibility](#input\_provider\_visibility) | Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints). | `string` | `"private"` | no |
41+
| <a name="input_region"></a> [region](#input\_region) | The region to provision Security and Compliance Center Workload Protection resources in. | `string` | `"us-south"` | no |
42+
| <a name="input_scc_workload_protection_access_tags"></a> [scc\_workload\_protection\_access\_tags](#input\_scc\_workload\_protection\_access\_tags) | A list of access tags to apply to the Workload Protection instance. Maximum length: 128 characters. Possible characters are A-Z, 0-9, spaces, underscores, hyphens, periods, and colons. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits). | `list(string)` | `[]` | no |
43+
| <a name="input_scc_workload_protection_instance_name"></a> [scc\_workload\_protection\_instance\_name](#input\_scc\_workload\_protection\_instance\_name) | The name for the Workload Protection instance that is created by this solution. Must begin with a letter. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"scc-workload-protection"` | no |
44+
| <a name="input_scc_workload_protection_instance_tags"></a> [scc\_workload\_protection\_instance\_tags](#input\_scc\_workload\_protection\_instance\_tags) | The list of tags to add to the Workload Protection instance. | `list(string)` | `[]` | no |
45+
| <a name="input_scc_workload_protection_resource_key_tags"></a> [scc\_workload\_protection\_resource\_key\_tags](#input\_scc\_workload\_protection\_resource\_key\_tags) | The tags associated with the Workload Protection resource key. | `list(string)` | `[]` | no |
46+
| <a name="input_scc_workload_protection_service_plan"></a> [scc\_workload\_protection\_service\_plan](#input\_scc\_workload\_protection\_service\_plan) | The pricing plan for the Workload Protection instance service. Possible values: `free-trial`, `graduated-tier`. | `string` | `"graduated-tier"` | no |
47+
48+
### Outputs
49+
50+
| Name | Description |
51+
|------|-------------|
52+
| <a name="output_resource_group_id"></a> [resource\_group\_id](#output\_resource\_group\_id) | Resource group ID |
53+
| <a name="output_resource_group_name"></a> [resource\_group\_name](#output\_resource\_group\_name) | Resource group name |
54+
| <a name="output_scc_workload_protection_access_key"></a> [scc\_workload\_protection\_access\_key](#output\_scc\_workload\_protection\_access\_key) | SCC Workload Protection access key |
55+
| <a name="output_scc_workload_protection_api_endpoint"></a> [scc\_workload\_protection\_api\_endpoint](#output\_scc\_workload\_protection\_api\_endpoint) | SCC Workload Protection API endpoint |
56+
| <a name="output_scc_workload_protection_crn"></a> [scc\_workload\_protection\_crn](#output\_scc\_workload\_protection\_crn) | SCC Workload Protection instance CRN |
57+
| <a name="output_scc_workload_protection_id"></a> [scc\_workload\_protection\_id](#output\_scc\_workload\_protection\_id) | SCC Workload Protection instance ID |
58+
| <a name="output_scc_workload_protection_ingestion_endpoint"></a> [scc\_workload\_protection\_ingestion\_endpoint](#output\_scc\_workload\_protection\_ingestion\_endpoint) | SCC Workload Protection instance ingestion endpoint |
59+
| <a name="output_scc_workload_protection_name"></a> [scc\_workload\_protection\_name](#output\_scc\_workload\_protection\_name) | SCC Workload Protection instance name |
60+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎solutions/fully-configurable/catalogValidationValues.json.template‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"ibmcloud_api_key": $VALIDATION_APIKEY,
3+
"existing_resource_group_name": "geretain-test-resources"
4+
}

‎solutions/fully-configurable/cbr-rules.md‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Configuring complex inputs for Workload Protection in IBM Cloud projects
2+
3+
Several optional input variables in the IBM Cloud [workload protection deployable architecture](https://cloud.ibm.com/catalog#deployable_architecture) use complex object types. You specify these inputs when you configure deployable architecture.
4+
5+
* Context-Based Restrictions Rules (`cbr_rules`)
6+
7+
8+
## Rules For Context-Based Restrictions <a name="cbr_rules"></a>
9+
10+
The `cbr_rules` input variable allows you to provide a rule for the target service to enforce access restrictions for the service based on the context of access requests. Contexts are criteria that include the network location of access requests, the endpoint type from where the request is sent, etc.
11+
12+
- Variable name: `cbr_rules`.
13+
- Type: A list of objects. Allows only one object representing a rule for the target service
14+
- Default value: An empty list (`[]`).
15+
16+
### Options for cbr_rules
17+
18+
- `description` (required): The description of the rule to create.
19+
- `account_id` (required): The IBM Cloud Account ID
20+
- `rule_contexts` (required): (List) The contexts the rule applies to
21+
- `attributes` (optional): (List) Individual context attributes
22+
- `name` (required): The attribute name.
23+
- `value` (required): The attribute value.
24+
25+
- `enforcement_mode` (required): The rule enforcement mode can have the following values:
26+
- `enabled` - The restrictions are enforced and reported. This is the default.
27+
- `disabled` - The restrictions are disabled. Nothing is enforced or reported.
28+
- `report` - The restrictions are evaluated and reported, but not enforced.
29+
- `tags` (optional): (List) Resource Tags .
30+
- `name` (required): The Tag name.
31+
- `value` (required): The Tag value.
32+
- `operations` (optional): The operations this rule applies to
33+
- `api_types`(required): (List) The API types this rule applies to.
34+
- `api_type_id`(required):The API type ID
35+
36+
### Example Rule For Context-Based Restrictions Configuration
37+
38+
```hcl
39+
[
40+
{
41+
description = "workload protection can be accessed from xyz"
42+
account_id = "defc0df06b644a9cabc6e44f55b3880s."
43+
rule_contexts= [
44+
{
45+
attributes = [
46+
{
47+
"name" : "endpointType",
48+
"value" : "private"
49+
},
50+
{
51+
name = "networkZoneId"
52+
value = "93a51a1debe2674193217209601dde6f" # pragma: allowlist secret
53+
}
54+
]
55+
}
56+
]
57+
enforcement_mode = "enabled"
58+
resources = [
59+
{
60+
tags {
61+
name = "tag_name"
62+
value = "tag_value"
63+
}
64+
}
65+
]
66+
operations = [
67+
{
68+
api_types = [
69+
{
70+
api_type_id = "crn:v1:bluemix:public:context-based-restrictions::::api-type:"
71+
}
72+
]
73+
}
74+
]
75+
}
76+
]
77+
```

0 commit comments

Comments
 (0)