Skip to content

Commit 78012df

Browse files
Jordan-Williams2Jordan-Williams2
Jordan-Williams2
authored and
Jordan-Williams2
committed
feat: scc workload protection DA
1 parent a40ee6a commit 78012df

File tree

12 files changed

+375
-34
lines changed

12 files changed

+375
-34
lines changed

‎common-dev-assets‎

‎solutions/standard/README.md‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Security and Compliance Center instances solution
2+
3+
This solution supports provisioning and configuring the following infrastructure:
4+
5+
- A resource group, if one is not passed in.
6+
- A Security and Compliance Center Workload Protection instance.
7+
8+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).
9+
10+
11+
<!-- Below content is automatically populated via pre-commit hook -->
12+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
13+
### Requirements
14+
15+
| Name | Version |
16+
|------|---------|
17+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.4.0 |
18+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.75.2 |
19+
20+
### Modules
21+
22+
| Name | Source | Version |
23+
|------|--------|---------|
24+
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.1.6 |
25+
| <a name="module_scc_wp"></a> [scc\_wp](#module\_scc\_wp) | ../.. | n/a |
26+
27+
### Resources
28+
29+
No resources.
30+
31+
### Inputs
32+
33+
| Name | Description | Type | Default | Required |
34+
|------|-------------|------|---------|:--------:|
35+
| <a name="input_existing_monitoring_crn"></a> [existing\_monitoring\_crn](#input\_existing\_monitoring\_crn) | The CRN of an IBM Cloud Monitoring instance to to send Security and Compliance Object Storage bucket metrics to, as well as Workload Protection data. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. Ignored if using existing Object Storage bucket and not provisioning Workload Protection. | `string` | `null` | no |
36+
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key to deploy resources. | `string` | n/a | yes |
37+
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix to add to all resources that this solution creates. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | `"dev"` | no |
38+
| <a name="input_provider_visibility"></a> [provider\_visibility](#input\_provider\_visibility) | Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints). | `string` | `"private"` | no |
39+
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of a new or an existing resource group in which to provision resources to. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | n/a | yes |
40+
| <a name="input_scc_region"></a> [scc\_region](#input\_scc\_region) | The region to provision Security and Compliance Center resources in. | `string` | `"us-south"` | no |
41+
| <a name="input_scc_workload_protection_access_tags"></a> [scc\_workload\_protection\_access\_tags](#input\_scc\_workload\_protection\_access\_tags) | A list of access tags to apply to the Workload Protection instance. Maximum length: 128 characters. Possible characters are A-Z, 0-9, spaces, underscores, hyphens, periods, and colons. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits). | `list(string)` | `[]` | no |
42+
| <a name="input_scc_workload_protection_instance_name"></a> [scc\_workload\_protection\_instance\_name](#input\_scc\_workload\_protection\_instance\_name) | The name for the Workload Protection instance that is created by this solution. Must begin with a letter. Applies only if `provision_scc_workload_protection` is true. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-scc-wp"` | no |
43+
| <a name="input_scc_workload_protection_instance_tags"></a> [scc\_workload\_protection\_instance\_tags](#input\_scc\_workload\_protection\_instance\_tags) | The list of tags to add to the Workload Protection instance. | `list(string)` | `[]` | no |
44+
| <a name="input_scc_workload_protection_resource_key_tags"></a> [scc\_workload\_protection\_resource\_key\_tags](#input\_scc\_workload\_protection\_resource\_key\_tags) | The tags associated with the Workload Protection resource key. | `list(string)` | `[]` | no |
45+
| <a name="input_scc_workload_protection_service_plan"></a> [scc\_workload\_protection\_service\_plan](#input\_scc\_workload\_protection\_service\_plan) | The pricing plan for the Workload Protection instance service. Possible values: `free-trial`, `graduated-tier`. | `string` | `"graduated-tier"` | no |
46+
| <a name="input_use_existing_resource_group"></a> [use\_existing\_resource\_group](#input\_use\_existing\_resource\_group) | Whether to use an existing resource group. | `bool` | `false` | no |
47+
48+
### Outputs
49+
50+
| Name | Description |
51+
|------|-------------|
52+
| <a name="output_resource_group_id"></a> [resource\_group\_id](#output\_resource\_group\_id) | Resource group ID |
53+
| <a name="output_resource_group_name"></a> [resource\_group\_name](#output\_resource\_group\_name) | Resource group name |
54+
| <a name="output_scc_workload_protection_access_key"></a> [scc\_workload\_protection\_access\_key](#output\_scc\_workload\_protection\_access\_key) | SCC Workload Protection access key |
55+
| <a name="output_scc_workload_protection_api_endpoint"></a> [scc\_workload\_protection\_api\_endpoint](#output\_scc\_workload\_protection\_api\_endpoint) | SCC Workload Protection API endpoint |
56+
| <a name="output_scc_workload_protection_crn"></a> [scc\_workload\_protection\_crn](#output\_scc\_workload\_protection\_crn) | SCC Workload Protection instance CRN |
57+
| <a name="output_scc_workload_protection_id"></a> [scc\_workload\_protection\_id](#output\_scc\_workload\_protection\_id) | SCC Workload Protection instance ID |
58+
| <a name="output_scc_workload_protection_ingestion_endpoint"></a> [scc\_workload\_protection\_ingestion\_endpoint](#output\_scc\_workload\_protection\_ingestion\_endpoint) | SCC Workload Protection instance ingestion endpoint |
59+
| <a name="output_scc_workload_protection_name"></a> [scc\_workload\_protection\_name](#output\_scc\_workload\_protection\_name) | SCC Workload Protection instance name |
60+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎solutions/standard/catalogValidationValues.json.template‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"ibmcloud_api_key": $VALIDATION_APIKEY,
3+
"resource_group_name": $PREFIX
4+
}

‎solutions/standard/main.tf‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
locals {
2+
prefix = var.prefix != null ? (var.prefix != "" ? var.prefix : null) : null
3+
4+
scc_workload_protection_instance_name = try("${local.prefix}-${var.scc_workload_protection_instance_name}", var.scc_workload_protection_instance_name)
5+
scc_workload_protection_resource_key_name = try("${local.prefix}-${var.scc_workload_protection_instance_name}-key", "${var.scc_workload_protection_instance_name}-key")
6+
}
7+
8+
#######################################################################################################################
9+
# Resource Group
10+
#######################################################################################################################
11+
12+
module "resource_group" {
13+
source = "terraform-ibm-modules/resource-group/ibm"
14+
version = "1.1.6"
15+
resource_group_name = var.use_existing_resource_group == false ? try("${local.prefix}-${var.resource_group_name}", var.resource_group_name) : null
16+
existing_resource_group_name = var.use_existing_resource_group == true ? var.resource_group_name : null
17+
}
18+
19+
#######################################################################################################################
20+
# SCC Workload Protection
21+
#######################################################################################################################
22+
23+
module "scc_wp" {
24+
source = "../.."
25+
name = local.scc_workload_protection_instance_name
26+
region = var.scc_region
27+
resource_group_id = module.resource_group.resource_group_id
28+
resource_tags = var.scc_workload_protection_instance_tags
29+
resource_key_name = local.scc_workload_protection_resource_key_name
30+
resource_key_tags = var.scc_workload_protection_resource_key_tags
31+
cloud_monitoring_instance_crn = var.existing_monitoring_crn
32+
access_tags = var.scc_workload_protection_access_tags
33+
scc_wp_service_plan = var.scc_workload_protection_service_plan
34+
}

‎solutions/standard/outputs.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
2+
########################################################################################################################
3+
# Outputs
4+
########################################################################################################################
5+
6+
output "resource_group_name" {
7+
description = "Resource group name"
8+
value = module.resource_group.resource_group_name
9+
}
10+
11+
output "resource_group_id" {
12+
description = "Resource group ID"
13+
value = module.resource_group.resource_group_id
14+
}
15+
16+
output "scc_workload_protection_id" {
17+
description = "SCC Workload Protection instance ID"
18+
value = module.scc_wp.id
19+
}
20+
21+
output "scc_workload_protection_crn" {
22+
description = "SCC Workload Protection instance CRN"
23+
value = module.scc_wp.crn
24+
}
25+
26+
output "scc_workload_protection_name" {
27+
description = "SCC Workload Protection instance name"
28+
value = module.scc_wp.name
29+
}
30+
31+
output "scc_workload_protection_ingestion_endpoint" {
32+
description = "SCC Workload Protection instance ingestion endpoint"
33+
value = module.scc_wp.name
34+
}
35+
36+
output "scc_workload_protection_api_endpoint" {
37+
description = "SCC Workload Protection API endpoint"
38+
value = module.scc_wp.api_endpoint
39+
sensitive = true
40+
}
41+
42+
output "scc_workload_protection_access_key" {
43+
description = "SCC Workload Protection access key"
44+
value = module.scc_wp.access_key
45+
sensitive = true
46+
}

‎solutions/standard/provider.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
########################################################################################################################
2+
# Provider config
3+
########################################################################################################################
4+
5+
provider "ibm" {
6+
ibmcloud_api_key = var.ibmcloud_api_key
7+
region = var.scc_region
8+
visibility = var.provider_visibility
9+
}

‎solutions/standard/variables.tf‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
########################################################################################################################
2+
# Common variables
3+
########################################################################################################################
4+
5+
variable "ibmcloud_api_key" {
6+
type = string
7+
description = "The IBM Cloud API key to deploy resources."
8+
sensitive = true
9+
}
10+
11+
variable "use_existing_resource_group" {
12+
type = bool
13+
description = "Whether to use an existing resource group."
14+
default = false
15+
}
16+
17+
variable "resource_group_name" {
18+
type = string
19+
description = "The name of a new or an existing resource group in which to provision resources to. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
20+
}
21+
22+
variable "existing_monitoring_crn" {
23+
type = string
24+
nullable = true
25+
default = null
26+
description = "The CRN of an IBM Cloud Monitoring instance to to send Security and Compliance Object Storage bucket metrics to, as well as Workload Protection data. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. Ignored if using existing Object Storage bucket and not provisioning Workload Protection."
27+
}
28+
29+
variable "prefix" {
30+
type = string
31+
description = "The prefix to add to all resources that this solution creates. To not use any prefix value, you can set this value to `null` or an empty string."
32+
default = "dev"
33+
}
34+
35+
variable "provider_visibility" {
36+
description = "Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints)."
37+
type = string
38+
default = "private"
39+
40+
validation {
41+
condition = contains(["public", "private", "public-and-private"], var.provider_visibility)
42+
error_message = "Invalid visibility option. Allowed values are 'public', 'private', or 'public-and-private'."
43+
}
44+
}
45+
46+
########################################################################################################################
47+
# SCC variables
48+
########################################################################################################################
49+
50+
variable "scc_workload_protection_instance_name" {
51+
description = "The name for the Workload Protection instance that is created by this solution. Must begin with a letter. Applies only if `provision_scc_workload_protection` is true. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format."
52+
type = string
53+
default = "base-security-services-scc-wp"
54+
}
55+
56+
variable "scc_region" {
57+
type = string
58+
default = "us-south"
59+
description = "The region to provision Security and Compliance Center resources in."
60+
}
61+
62+
variable "scc_workload_protection_instance_tags" {
63+
type = list(string)
64+
description = "The list of tags to add to the Workload Protection instance."
65+
default = []
66+
}
67+
68+
variable "scc_workload_protection_resource_key_tags" {
69+
type = list(string)
70+
description = "The tags associated with the Workload Protection resource key."
71+
default = []
72+
}
73+
74+
variable "scc_workload_protection_access_tags" {
75+
type = list(string)
76+
description = "A list of access tags to apply to the Workload Protection instance. Maximum length: 128 characters. Possible characters are A-Z, 0-9, spaces, underscores, hyphens, periods, and colons. [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits)."
77+
default = []
78+
79+
validation {
80+
condition = alltrue([
81+
for tag in var.scc_workload_protection_access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128
82+
])
83+
error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details"
84+
}
85+
}
86+
87+
variable "scc_workload_protection_service_plan" {
88+
description = "The pricing plan for the Workload Protection instance service. Possible values: `free-trial`, `graduated-tier`."
89+
type = string
90+
default = "graduated-tier"
91+
validation {
92+
error_message = "Plan for Workload Protection instances can only be `free-trial` or `graduated-tier`."
93+
condition = contains(
94+
["free-trial", "graduated-tier"],
95+
var.scc_workload_protection_service_plan
96+
)
97+
}
98+
}

‎solutions/standard/version.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
terraform {
2+
required_version = ">= 1.4.0"
3+
# Lock DA into an exact provider version - renovate automation will keep it updated
4+
required_providers {
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = "1.75.2"
8+
}
9+
}
10+
}

‎tests/go.mod‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/terraform-ibm-modules/terraform-ibm-scc-workload-protection
22

3-
go 1.22.4
3+
go 1.23.0
44

55
toolchain go1.24.0
66

@@ -89,12 +89,13 @@ require (
8989
go.opentelemetry.io/otel/metric v1.29.0 // indirect
9090
go.opentelemetry.io/otel/trace v1.29.0 // indirect
9191
golang.org/x/crypto v0.33.0 // indirect
92-
golang.org/x/mod v0.18.0 // indirect
93-
golang.org/x/net v0.34.0 // indirect
92+
golang.org/x/exp v0.0.0-20250218142911-aa4b98e5adaa
93+
golang.org/x/mod v0.23.0 // indirect
94+
golang.org/x/net v0.35.0 // indirect
9495
golang.org/x/sync v0.11.0 // indirect
9596
golang.org/x/sys v0.30.0 // indirect
9697
golang.org/x/text v0.22.0 // indirect
97-
golang.org/x/tools v0.22.0 // indirect
98+
golang.org/x/tools v0.30.0 // indirect
9899
gopkg.in/warnings.v0 v0.1.2 // indirect
99100
gopkg.in/yaml.v2 v2.4.0 // indirect
100101
gopkg.in/yaml.v3 v3.0.1 // indirect

0 commit comments

Comments
 (0)