Skip to content

Commit be98644

Browse files
RiadhJouiniRiadhJouini
authored
chore: Full chain of deploy added (#208)
1 parent e09fec6 commit be98644

File tree

7 files changed

+466
-0
lines changed

7 files changed

+466
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ A module for provisioning an [IBM Cloud Security and Compliance Center Workload
1717
* [Examples](./examples)
1818
* [Advanced example](./examples/advanced)
1919
* [Basic example](./examples/basic)
20+
* [Enterprise Example: SCC-WP with App Config and Trusted Profiles](./examples/enterprise)
2021
* [Contributing](#contributing)
2122
<!-- END OVERVIEW HOOK -->
2223

‎examples/enterprise/README.md‎

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
# Enterprise Example: SCC-WP with App Config and Trusted Profiles
2+
3+
> Only supported in an enterprise account.
4+
5+
This example demonstrates the full deployment of:
6+
7+
- IBM Cloud App Configuration
8+
- IBM Cloud Security and Compliance Center Workload Protection (SCC-WP)
9+
- IAM Trusted Profile Template with 3 Trusted Profiles
10+
- Template assignment to account groups
11+
- Configuration Aggregator to link SCC-WP with App Config
12+
13+
---
14+
15+
## Flow Overview
16+
17+
1. **Create or reuse a resource group**
18+
A resource group is created or reused.
19+
20+
2. **Deploy App Config**
21+
App Config is deployed along with a collection for organizing features and properties.
22+
23+
3. **Deploy SCC Workload Protection**
24+
SCC-WP is deployed with the `graduated-tier` plan.
25+
26+
4. **Create a Trusted Profile Template with 3 profiles**
27+
- **App Config -- Enterprise**
28+
For IAM template management across the enterprise.
29+
- **App Config -- General**
30+
For reading platform and IAM services.
31+
- **SCC-WP Profile**
32+
For integrating SCC-WP with App Config and enterprise usage.
33+
34+
5. **Assign the template to account groups**
35+
All child accounts or specific account groups receive the profile template.
36+
37+
6. **Create SCC-WP Config Aggregator**
38+
The aggregator connects SCC-WP to App Config and uses the enterprise trusted profile and template ID to enforce secure access.
39+
40+
---
41+
42+
## Notes
43+
44+
- The `trusted_profile_links` block in each trusted profile is used to **link the profile to a specific CRN**, like a VSI or App Config instance, enabling the identity to assume the trusted profile.
45+
46+
---
47+
48+
## Usage
49+
50+
```bash
51+
terraform init
52+
terraform apply
53+
```
54+
55+
---
56+
57+
## Known issue
58+
59+
There is a [known issue](https://github.com/IBM-Cloud/terraform-provider-ibm/issues/6164) which you will face if you attempt a re-apply of this example after the initial apply has complete.
60+
61+
- The `ibm_iam_trusted_profile_template` will detect a update in place which looks something like this:
62+
```
63+
Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
64+
~ update in-place
65+
66+
Terraform will perform the following actions:
67+
68+
# module.trusted_profile_template.ibm_iam_trusted_profile_template.trusted_profile_template_instance will be updated in-place
69+
~ resource "ibm_iam_trusted_profile_template" "trusted_profile_template_instance" {
70+
id = "ProfileTemplate-8b16cb82-b9b4-434a-b678-12c82033e9a7/1"
71+
name = "Trusted Profile Template for SCC-WP"
72+
# (11 unchanged attributes hidden)
73+
74+
~ profile {
75+
name = "Trusted Profile for IBM Cloud CSPM in SCC-WP"
76+
# (1 unchanged attribute hidden)
77+
78+
~ identities {
79+
~ iam_id = "crn-crn:v1:bluemix:public:apprapp:us-south:a/1f27e30e31f0486980cb0b2657d483f7:c89c16ce-3505-453e-8990-c7473657779b::" -> "crn:v1:bluemix:public:apprapp:us-south:a/1f27e30e31f0486980cb0b2657d483f7:c89c16ce-3505-453e-8990-c7473657779b::"
80+
# (4 unchanged attributes hidden)
81+
}
82+
}
83+
84+
# (2 unchanged blocks hidden)
85+
}
86+
```
87+
- Any account groups that were assigned the trusted profile template will also see an update in place. For example:
88+
```
89+
# module.trusted_profile_template.ibm_iam_trusted_profile_template_assignment.account_settings_template_assignment_instance["AccountGroup-3596923e5a674a7fa7eb01c5b17fce8e"] will be updated in-place
90+
~ resource "ibm_iam_trusted_profile_template_assignment" "account_settings_template_assignment_instance" {
91+
id = "TemplateAssignment-befcf82f-6bd2-4922-b2c1-5c161685488c"
92+
+ resources = (known after apply)
93+
# (13 unchanged attributes hidden)
94+
}
95+
```
96+
- If you then proceed with the apply, it will fail with the following error:
97+
```
98+
module.trusted_profile_template.ibm_iam_trusted_profile_template.trusted_profile_template_instance: Modifying... [id=ProfileTemplate-8b16cb82-b9b4-434a-b678-12c82033e9a7/1]
99+
╷
100+
│ Error: UpdateProfileTemplateVersionWithContext failed Template in committed state.
101+
│ {
102+
│ "StatusCode": 422,
103+
│ "Headers": {
104+
│ "Akamai-Grn": [
105+
│ "0.bdb01302.1744900183.cacb5e65"
106+
│ ],
107+
│ "Cache-Control": [
108+
│ "no-cache, no-store, must-revalidate"
109+
│ ],
110+
│ "Content-Language": [
111+
│ "en-US"
112+
│ ],
113+
│ "Content-Length": [
114+
│ "334"
115+
│ ],
116+
│ "Content-Type": [
117+
│ "application/json"
118+
│ ],
119+
│ "Date": [
120+
│ "Thu, 17 Apr 2025 14:29:43 GMT"
121+
│ ],
122+
│ "Expires": [
123+
│ "0"
124+
│ ],
125+
│ "Ibm-Cloud-Service-Name": [
126+
│ "iam-identity"
127+
│ ],
128+
│ "Pragma": [
129+
│ "no-cache"
130+
│ ],
131+
│ "Set-Cookie": [
132+
│ "ak_bmsc=540034860F090FE00019133754696C9B~000000000000000000000000000000~YAAQvbATAmL0BRuWAQAA59YnRBuMehleeYJJD1yOUDM/362Yj0eaMmjUwIsm8G4Muf/XUfjIHA5XJGWRI1lc21CDcPI7yVqdHcX5h4l59hxg+cqzHDBeNUIojafPY7k82U8X9ECSo5XFuyfFx4tlSOVclDZ05o2vLfNlpsi+Gr8kBbwySy/XGjfPi5g0ZLRq1Segl+vK7mV2HNdboRRw2MKdZpxYUgIrx/WhFgsuIgZBx6xzDLVjLYZHfFhZ1pF/s/vgOC9pPv8oAOxbas8pvR0hfeL4/9tNLiqws2kMal8wDeuytpy0qEzFLvlFRTa9YG0GYXthz5MxlA/VX5fnxfPcc7SGW2dTu1JFYKig/SapnDnqJCo/n/YlJLrjfguPWQjK; Domain=.cloud.ibm.com; Path=/; Expires=Thu, 17 Apr 2025 16:29:43 GMT; Max-Age=7200"
133+
│ ],
134+
│ "Strict-Transport-Security": [
135+
│ "max-age=31536000; includeSubDomains"
136+
│ ],
137+
│ "Transaction-Id": [
138+
│ "OXRxZ2M-8c573b755d4f4a28bb60756766ea1c64"
139+
│ ],
140+
│ "X-Content-Type-Options": [
141+
│ "nosniff"
142+
│ ],
143+
│ "X-Correlation-Id": [
144+
│ "OXRxZ2M-8c573b755d4f4a28bb60756766ea1c64"
145+
│ ],
146+
│ "X-Proxy-Upstream-Service-Time": [
147+
│ "127"
148+
│ ],
149+
│ "X-Request-Id": [
150+
│ "81085e6c-1d77-4916-84c5-e4574956e456"
151+
│ ]
152+
│ },
153+
│ "Result": {
154+
│ "errors": [
155+
│ {
156+
│ "code": "invalid_state",
157+
│ "details": "Unable to process this request as Template with ID 'ProfileTemplate-8b16cb82-b9b4-434a-b678-12c82033e9a7' and version '1' is in a committed state.",
158+
│ "message": "Template in committed state.",
159+
│ "message_code": "BXNIM0908E"
160+
│ }
161+
│ ],
162+
│ "status_code": 422,
163+
│ "trace": "OXRxZ2M-8c573b755d4f4a28bb60756766ea1c64"
164+
│ },
165+
│ "RawResult": null
166+
│ }
167+
│
168+
│
169+
│ with module.trusted_profile_template.ibm_iam_trusted_profile_template.trusted_profile_template_instance,
170+
│ on .terraform/modules/trusted_profile_template/modules/trusted-profile-template/main.tf line 26, in resource "ibm_iam_trusted_profile_template" "trusted_profile_template_instance":
171+
│ 26: resource "ibm_iam_trusted_profile_template" "trusted_profile_template_instance" {
172+
```

‎examples/enterprise/main.tf‎

Lines changed: 216 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
########################################################################################################################
2+
# Resource group
3+
########################################################################################################################
4+
5+
module "resource_group" {
6+
source = "terraform-ibm-modules/resource-group/ibm"
7+
version = "1.1.6"
8+
resource_group_name = var.resource_group == null ? "${var.prefix}-rg" : null
9+
existing_resource_group_name = var.resource_group
10+
}
11+
12+
########################################################################################################################
13+
# SCC Workload Protection
14+
########################################################################################################################
15+
16+
# Create SCC Workload Protection instance
17+
module "scc_wp" {
18+
source = "../.."
19+
name = var.prefix
20+
region = var.region
21+
resource_group_id = module.resource_group.resource_group_id
22+
resource_tags = var.resource_tags
23+
access_tags = var.access_tags
24+
scc_wp_service_plan = "graduated-tier"
25+
}
26+
27+
# Create Trusted profile for SCC Workload Protection instance
28+
module "trusted_profile_scc_wp" {
29+
source = "terraform-ibm-modules/trusted-profile/ibm"
30+
version = "2.1.0"
31+
trusted_profile_name = "${var.prefix}-scc-wp-profile"
32+
trusted_profile_description = "Trusted Profile for SCC-WP to access App Config and enterprise"
33+
34+
trusted_profile_identity = {
35+
identifier = module.scc_wp.crn
36+
identity_type = "crn"
37+
type = "crn"
38+
}
39+
40+
trusted_profile_policies = [
41+
{
42+
roles = ["Viewer", "Service Configuration Reader", "Manager"]
43+
resources = [{
44+
service = "apprapp"
45+
}]
46+
description = "App Config access"
47+
},
48+
{
49+
roles = ["Viewer", "Usage Report Viewer"]
50+
resources = [{
51+
service = "enterprise"
52+
}]
53+
description = "Enterprise access"
54+
}
55+
]
56+
57+
trusted_profile_links = [{
58+
cr_type = "VSI"
59+
links = [{
60+
crn = module.scc_wp.crn
61+
}]
62+
}]
63+
}
64+
65+
########################################################################################################################
66+
# App Config
67+
########################################################################################################################
68+
69+
# Create new App Config instance
70+
module "app_config" {
71+
source = "terraform-ibm-modules/app-configuration/ibm"
72+
version = "1.3.0"
73+
region = var.region
74+
resource_group_id = module.resource_group.resource_group_id
75+
app_config_name = "${var.prefix}-app-config"
76+
app_config_tags = var.resource_tags
77+
}
78+
79+
# Create trusted profile for App Config instance
80+
module "trusted_profile_app_config_general" {
81+
source = "terraform-ibm-modules/trusted-profile/ibm"
82+
version = "2.1.0"
83+
trusted_profile_name = "${var.prefix}-app-config-general-profile"
84+
trusted_profile_description = "Trusted Profile for App Config general permissions"
85+
86+
trusted_profile_identity = {
87+
identifier = module.app_config.app_config_crn
88+
identity_type = "crn"
89+
type = "crn"
90+
}
91+
92+
trusted_profile_policies = [
93+
{
94+
roles = ["Viewer", "Service Configuration Reader"]
95+
account_management = true
96+
description = "All Account Management Services"
97+
},
98+
{
99+
roles = ["Viewer", "Service Configuration Reader", "Reader"]
100+
resource_attributes = [{
101+
name = "serviceType"
102+
value = "service"
103+
operator = "stringEquals"
104+
}]
105+
description = "All Identity and Access enabled services"
106+
}
107+
]
108+
109+
trusted_profile_links = [{
110+
cr_type = "VSI"
111+
links = [{
112+
crn = module.app_config.app_config_crn
113+
}]
114+
}]
115+
}
116+
117+
# Creates the custom role inline
118+
# This role, "Template Assignment Reader", is used in the trusted profile
119+
# to grant permission to read IAM template assignments. It is required
120+
# by the App Config enterprise-level trusted profile to manage IAM templates.
121+
resource "ibm_iam_custom_role" "template_assignment_reader" {
122+
name = "TemplateAssignmentReader"
123+
service = "iam-identity"
124+
display_name = "Template Assignment Reader"
125+
description = "Custom role to allow reading template assignments"
126+
actions = ["iam-identity.profile-assignment.read"]
127+
}
128+
129+
# Trusted Profile for App Config enterprise-level permissions
130+
module "trusted_profile_app_config_enterprise" {
131+
source = "terraform-ibm-modules/trusted-profile/ibm"
132+
version = "2.1.0"
133+
trusted_profile_name = "app-config-enterprise-profile"
134+
trusted_profile_description = "Trusted Profile for App Config to manage IAM templates"
135+
136+
trusted_profile_identity = {
137+
identifier = module.app_config.app_config_crn
138+
identity_type = "crn"
139+
type = "crn"
140+
}
141+
142+
trusted_profile_policies = [
143+
{
144+
roles = ["Viewer", "Template Assignment Reader"]
145+
resource_attributes = [{
146+
name = "service_group_id"
147+
value = "IAM"
148+
operator = "stringEquals"
149+
}]
150+
description = "IAM access with custom role"
151+
},
152+
{
153+
roles = ["Viewer"]
154+
resources = [{
155+
service = "enterprise"
156+
}]
157+
description = "Enterprise access"
158+
}
159+
]
160+
161+
trusted_profile_links = [{
162+
cr_type = "VSI"
163+
links = [{
164+
crn = module.app_config.app_config_crn
165+
}]
166+
}]
167+
}
168+
169+
# Enable the config aggregator
170+
resource "ibm_config_aggregator_settings" "scc_wp_aggregator" {
171+
instance_id = module.app_config.app_config_guid
172+
region = var.region
173+
resource_collection_enabled = true
174+
resource_collection_regions = ["all"]
175+
trusted_profile_id = module.trusted_profile_app_config_general.profile_id
176+
177+
additional_scope {
178+
type = "Enterprise"
179+
enterprise_id = var.enterprise_id
180+
181+
profile_template {
182+
id = module.trusted_profile_template.trusted_profile_template_id
183+
trusted_profile_id = module.trusted_profile_app_config_enterprise.profile_id
184+
}
185+
}
186+
}
187+
188+
########################################################################################################################
189+
# Trusted profile template
190+
########################################################################################################################
191+
192+
module "trusted_profile_template" {
193+
source = "terraform-ibm-modules/trusted-profile/ibm//modules/trusted-profile-template"
194+
version = "2.1.0"
195+
template_name = "Trusted Profile Template for SCC-WP-${var.prefix}"
196+
template_description = "IAM trusted profile template to onboard accounts for CSPM"
197+
profile_name = "Trusted Profile for IBM Cloud CSPM in SCC-WP"
198+
profile_description = "Template profile used to onboard child accounts"
199+
identity_crn = module.app_config.app_config_crn
200+
onboard_all_account_groups = true
201+
202+
policy_templates = [
203+
{
204+
name = "identity-access"
205+
description = "Policy template for identity services"
206+
roles = ["Viewer", "Reader"]
207+
service = "service"
208+
},
209+
{
210+
name = "platform-access"
211+
description = "Policy template for platform services"
212+
roles = ["Viewer", "Service Configuration Reader"]
213+
service = "platform_service"
214+
}
215+
]
216+
}

0 commit comments

Comments
 (0)