Skip to content

Commit 64516ac

Browse files
ocofaighocofaigh
authored
chore: fix the enterprise example (#262)
1 parent cb1d389 commit 64516ac

File tree

6 files changed

+39
-88
lines changed

6 files changed

+39
-88
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ A module for provisioning an [IBM Cloud Security and Compliance Center Workload
1717
* [Examples](./examples)
1818
* [Advanced example](./examples/advanced)
1919
* [Basic example](./examples/basic)
20-
* [Enterprise Example: SCC-WP with App Config and Trusted Profiles](./examples/enterprise)
20+
* [Enterprise example with CSPM enabled](./examples/enterprise)
2121
* [Contributing](#contributing)
2222
<!-- END OVERVIEW HOOK -->
2323

‎examples/enterprise/README.md‎

Lines changed: 4 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -1,61 +1,6 @@
1-
# Enterprise Example: SCC-WP with App Config and Trusted Profiles
1+
# Enterprise example with CSPM enabled
22

3-
> Only supported in an enterprise account.
3+
The following example shows how to configure IBM Cloud Security and Compliance Center Workload Protection for Cloud Security Posture Management (CSPM) in an enterprise.
44

5-
This example demonstrates a full deployment using modular Terraform code, including:
6-
7-
- **IBM Cloud App Configuration** (App Config)
8-
- **IBM Cloud Security and Compliance Center Workload Protection** (SCC-WP)
9-
- **IAM Trusted Profiles** for secure integration
10-
- **Resource Group** creation or reuse
11-
- **Configuration Aggregator** to link SCC-WP with App Config
12-
13-
---
14-
15-
## Module Overview
16-
17-
- **Resource Group Module**
18-
Creates or reuses a resource group for all resources.
19-
20-
- **SCC Workload Protection Module**
21-
Deploys the SCC-WP instance, attaches tags, and (optionally) enables CSPM and trusted profiles based on input variables.
22-
23-
- **App Config Module**
24-
Deploys an App Config instance with enterprise plan, tags, and enables the configuration aggregator with a trusted profile.
25-
26-
---
27-
28-
## Flow Overview
29-
30-
1. **Resource Group**
31-
A resource group is created or reused for all resources.
32-
33-
2. **App Config**
34-
Deploys App Config with the enterprise plan, tags, and enables the configuration aggregator with a trusted profile.
35-
36-
3. **SCC Workload Protection**
37-
Deploys SCC-WP with the `graduated-tier` plan, attaches resource and access tags, and (optionally) enables CSPM and trusted profiles for secure integration.
38-
39-
4. **Trusted Profiles**
40-
Trusted profiles are created and linked as needed for App Config and SCC-WP, with enterprise access policies conditionally included if enabled.
41-
42-
5. **Configuration Aggregator**
43-
Connects SCC-WP to App Config using the trusted profile and template ID for secure access across the enterprise.
44-
45-
---
46-
47-
## Notes
48-
49-
- The `trusted_profile_links` block in each trusted profile links the profile to a specific CRN (e.g., VSI or App Config instance), enabling the identity to assume the trusted profile.
50-
- Enterprise-specific access policies are conditionally added based on input variables (e.g., `enterprise_enabled`).
51-
52-
---
53-
54-
## Usage
55-
56-
```bash
57-
terraform init
58-
terraform apply
59-
```
60-
61-
---
5+
- Use the App Config module to create an App Config instance with configuration aggregator enabled. This module will also create a trusted profile with viewer / reader access for all Account Management and Identity and Access enabled services. It will also create a trusted profile template which will be applied to the given enterprise sub-accounts to scan the resources in those accounts.
6+
- Use the Security and Compliance Center Workload Protection module to create a new instance of SCC Workload Protection with Cloud Security Posture Management (CSPM) enabled. The module will also create a trusted profile with viewer access to the App Config instance in order to be able to populate the inventory.

‎examples/enterprise/main.tf‎

Lines changed: 30 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -10,34 +10,41 @@ module "resource_group" {
1010
}
1111

1212
########################################################################################################################
13-
# SCC Workload Protection
13+
# App Config with config aggregator enabled
1414
########################################################################################################################
1515

16-
# Create SCC Workload Protection instance
17-
module "scc_wp" {
18-
source = "../.."
19-
name = var.prefix
20-
region = var.region
21-
resource_group_id = module.resource_group.resource_group_id
22-
resource_tags = var.resource_tags
23-
access_tags = var.access_tags
24-
scc_wp_service_plan = "graduated-tier"
16+
module "app_config" {
17+
source = "terraform-ibm-modules/app-configuration/ibm"
18+
version = "1.8.2"
19+
region = var.region
20+
resource_group_id = module.resource_group.resource_group_id
21+
app_config_plan = "basic"
22+
app_config_name = "${var.prefix}-app-config"
23+
app_config_tags = var.resource_tags
24+
enable_config_aggregator = true
25+
config_aggregator_trusted_profile_name = "${var.prefix}-app-config-tp"
26+
config_aggregator_resource_collection_regions = ["all"] # supports passing list of regions, or "all" for all regions
27+
config_aggregator_enterprise_id = var.enterprise_id
28+
config_aggregator_enterprise_trusted_profile_template_name = "${var.prefix}-app-config-tp-template"
29+
config_aggregator_enterprise_account_group_ids_to_assign = ["all"] # supports passing list of account groups. Use 'config_aggregator_enterprise_account_ids_to_assign' to pass individual accounts
2530
}
2631

2732
########################################################################################################################
28-
# App Config
33+
# SCC Workload Protection with CSPM enabled
2934
########################################################################################################################
3035

31-
# Create new App Config instance
32-
module "app_config" {
33-
source = "terraform-ibm-modules/app-configuration/ibm"
34-
version = "1.8.2"
35-
region = var.region
36-
resource_group_id = module.resource_group.resource_group_id
37-
app_config_plan = "enterprise"
38-
app_config_name = "${var.prefix}-app-config"
39-
app_config_tags = var.resource_tags
40-
enable_config_aggregator = true
41-
config_aggregator_trusted_profile_name = "${var.prefix}-app-config-tp"
42-
config_aggregator_enterprise_id = var.enterprise_id
36+
module "scc_wp" {
37+
source = "../.."
38+
# remove the above line and uncomment the below 2 lines to consume the module from the registry
39+
# source = "terraform-ibm-modules/scc-workload-protection/ibm"
40+
# version = "X.Y.Z" # Replace "X.Y.Z" with a release version to lock into a specific release
41+
name = var.prefix
42+
region = var.region
43+
resource_group_id = module.resource_group.resource_group_id
44+
resource_tags = var.resource_tags
45+
access_tags = var.access_tags
46+
scc_wp_service_plan = "graduated-tier"
47+
cspm_enabled = true
48+
app_config_crn = module.app_config.app_config_crn
49+
scc_workload_protection_trusted_profile_name = "${var.prefix}-scc-wp-tp"
4350
}

‎examples/enterprise/outputs.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ output "scc_wp_crn" {
33
value = module.scc_wp.crn
44
}
55

6-
output "trusted_profile_enterprise_id" {
7-
description = "Trusted profile enterprise ID"
6+
output "enterprise_id" {
7+
description = "Enterprise ID"
88
value = var.enterprise_id
99
}
1010

‎examples/enterprise/provider.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,8 @@ provider "ibm" {
55

66
data "ibm_iam_auth_token" "auth_token" {}
77

8-
# Null resource replaced with restapi_object to enable CSPM
98
provider "restapi" {
10-
uri = "https://resource-controller.cloud.ibm.com"
9+
uri = "https://resource-controller.cloud.ibm.com" # See https://cloud.ibm.com/apidocs/resource-controller/resource-controller#endpoint-url for all possible endpoints
1110
headers = {
1211
Authorization = data.ibm_iam_auth_token.auth_token.iam_access_token
1312
}

‎examples/enterprise/variables.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
variable "enterprise_id" {
22
type = string
3-
description = "The Enterprise ID used to scope the Config Aggregator or IAM templates."
3+
description = "The ID of the enterprise."
44
}
55

66
variable "region" {

0 commit comments

Comments
 (0)