Skip to content

Commit fbae7e4

Browse files
mukulpalit-ibmmukulpalit-ibm
authored
feat: added logic to determine if account is an enterprise and if it is configure CSPM for enterprise type (#337)
1 parent 4531b7b commit fbae7e4

File tree

10 files changed

+170
-0
lines changed

10 files changed

+170
-0
lines changed

‎README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@ A module for provisioning an [IBM Cloud Security and Compliance Center Workload
1414
<!-- BEGIN OVERVIEW HOOK -->
1515
## Overview
1616
* [terraform-ibm-scc-workload-protection](#terraform-ibm-scc-workload-protection)
17+
* [Submodules](./modules)
18+
* [account_check](./modules/account_check)
1719
* [Examples](./examples)
1820
* [Advanced example](./examples/advanced)
1921
* [Basic example](./examples/basic)
@@ -114,6 +116,7 @@ statement instead the previous block.
114116

115117
| Name | Source | Version |
116118
|------|--------|---------|
119+
| <a name="module_account_type_check"></a> [account\_type\_check](#module\_account\_type\_check) | ./modules/account_check | n/a |
117120
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.33.7 |
118121
| <a name="module_trusted_profile_scc_wp"></a> [trusted\_profile\_scc\_wp](#module\_trusted\_profile\_scc\_wp) | terraform-ibm-modules/trusted-profile/ibm | 3.1.1 |
119122

@@ -125,6 +128,7 @@ statement instead the previous block.
125128
| [ibm_resource_key.scc_wp_resource_key](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_key) | resource |
126129
| [ibm_resource_tag.scc_wp_access_tag](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/resources/resource_tag) | resource |
127130
| [restapi_object.cspm](https://registry.terraform.io/providers/Mastercard/restapi/latest/docs/resources/object) | resource |
131+
| [ibm_iam_auth_token.token](https://registry.terraform.io/providers/ibm-cloud/ibm/latest/docs/data-sources/iam_auth_token) | data source |
128132

129133
### Inputs
130134

‎main.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,10 @@
88
# SCC WP
99
##############################################################################
1010

11+
locals {
12+
target_account_id = ibm_resource_instance.scc_wp.account_id
13+
}
14+
1115
resource "ibm_resource_instance" "scc_wp" {
1216
name = var.name
1317
resource_group_id = var.resource_group_id
@@ -20,6 +24,22 @@ resource "ibm_resource_instance" "scc_wp" {
2024
}
2125
}
2226

27+
##############################################################################
28+
# Check Account Type
29+
##############################################################################
30+
31+
data "ibm_iam_auth_token" "token" {
32+
depends_on = [ibm_resource_instance.scc_wp]
33+
count = var.cspm_enabled ? 1 : 0
34+
}
35+
36+
module "account_type_check" {
37+
count = var.cspm_enabled ? 1 : 0
38+
source = "./modules/account_check"
39+
target_account_id = local.target_account_id
40+
iam_token = data.ibm_iam_auth_token.token[0].iam_access_token
41+
}
42+
2343
##############################################################################
2444
# SCC WP Instance Key
2545
##############################################################################
@@ -136,6 +156,7 @@ resource "restapi_object" "cspm" {
136156
target_accounts = var.cspm_enabled ? [
137157
{
138158
account_id = ibm_resource_instance.scc_wp.account_id
159+
account_type = module.account_type_check[0].account_type
139160
config_crn = var.app_config_crn
140161
trusted_profile_id = module.trusted_profile_scc_wp[0].profile_id
141162
}

‎modules/account_check/README.md‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Account Check
2+
3+
This module determines whether a given IBM Cloud account is part of an `ENTERPRISE` or is a `Standalone (ACCOUNT)` account.
4+
It uses the IBM Cloud Enterprise Management API and can be easily integrated into Terraform configurations via the external data source.
5+
6+
### Prerequisites
7+
8+
This module utilizes an external script that relies on the following command-line tools being installed on the system where Terraform is executed:
9+
- `jq`: A lightweight and flexible command-line JSON processor. It is required for parsing the input provided by the Terraform external data source.
10+
- `curl`: A tool to transfer data with URLs, required for making API calls to the IBM Cloud Enterprise Management API.
11+
12+
### Usage
13+
```hcl
14+
module "account_type_check" {
15+
source = "terraform-ibm-modules/scc-workload-protection/ibm//modules/account_check"
16+
target_account_id = <ACCOUNT_ID>
17+
iam_token = "XXXXXXXXXXXXXX" # pragma: allowlist secret
18+
}
19+
```
20+
21+
### Required IAM access policies
22+
23+
- Account Management
24+
- **Enterprise** service
25+
- `Viewer` platform access
26+
- **All Identity and Access enabled** services
27+
- `Viewer` platform access
28+
29+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
30+
### Requirements
31+
32+
| Name | Version |
33+
|------|---------|
34+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
35+
| <a name="requirement_external"></a> [external](#requirement\_external) | >= 2.3.5, <3.0.0 |
36+
37+
### Modules
38+
39+
No modules.
40+
41+
### Resources
42+
43+
| Name | Type |
44+
|------|------|
45+
| [external_external.account_check](https://registry.terraform.io/providers/hashicorp/external/latest/docs/data-sources/external) | data source |
46+
47+
### Inputs
48+
49+
| Name | Description | Type | Default | Required |
50+
|------|-------------|------|---------|:--------:|
51+
| <a name="input_iam_token"></a> [iam\_token](#input\_iam\_token) | The IBM Cloud platform IAM token needed to authenticate deploy IAM enabled resources. | `string` | n/a | yes |
52+
| <a name="input_target_account_id"></a> [target\_account\_id](#input\_target\_account\_id) | The ID of the target account to check for type. | `string` | n/a | yes |
53+
54+
### Outputs
55+
56+
| Name | Description |
57+
|------|-------------|
58+
| <a name="output_account_type"></a> [account\_type](#output\_account\_type) | The determined type of the IBM Cloud account. |
59+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

‎modules/account_check/main.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
locals {
2+
# Set account_type variable from the external data source's JSON output.
3+
account_type = data.external.account_check.result.account_type
4+
}
5+
6+
data "external" "account_check" {
7+
program = ["/bin/bash", "${path.module}/../scripts/account-check.sh"]
8+
query = {
9+
account_id = var.target_account_id
10+
iam_token = var.iam_token
11+
}
12+
}

‎modules/account_check/outputs.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "account_type" {
2+
description = "The determined type of the IBM Cloud account."
3+
value = local.account_type
4+
}

‎modules/account_check/variables.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
variable "iam_token" {
2+
description = "The IBM Cloud platform IAM token needed to authenticate deploy IAM enabled resources."
3+
type = string
4+
sensitive = true
5+
}
6+
7+
variable "target_account_id" {
8+
description = "The ID of the target account to check for type."
9+
type = string
10+
}

‎modules/account_check/version.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_version = ">= 1.9.0"
3+
required_providers {
4+
external = {
5+
source = "hashicorp/external"
6+
version = ">= 2.3.5, <3.0.0"
7+
}
8+
}
9+
}

‎modules/scripts/account-check.sh‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
#!/bin/bash
2+
set -e
3+
4+
check_dependencies() {
5+
if ! command -v jq &> /dev/null; then
6+
echo "Error: 'jq' is required but not found. Please install 'jq' to run this script." >&2
7+
exit 1
8+
fi
9+
}
10+
11+
check_dependencies
12+
13+
get_enterprise_endpoint() {
14+
default_endpoint="enterprise.cloud.ibm.com"
15+
enterprise_endpoint="${IBMCLOUD_ENTERPRISE_API_ENDPOINT:-"$default_endpoint"}"
16+
ENTERPRISE_ENDPOINT=${enterprise_endpoint#https://}
17+
}
18+
19+
get_enterprise_endpoint
20+
21+
read -r TF_INPUT || true
22+
ACCOUNT_ID=$(echo "$TF_INPUT" | jq -r '.account_id')
23+
IAM_TOKEN=$(echo "$TF_INPUT" | jq -r '.iam_token')
24+
25+
URL="https://${ENTERPRISE_ENDPOINT}/v1/accounts/${ACCOUNT_ID}"
26+
27+
CURL_OUTPUT=$(curl -s -w "STATUS_CODE:%{http_code}" \
28+
--retry 3 \
29+
-X GET "$URL" \
30+
-H "Authorization: ${IAM_TOKEN}")
31+
32+
HTTP_CODE=$(echo "$CURL_OUTPUT" | grep -o 'STATUS_CODE:[0-9]*$' | awk -F: '{print $2}')
33+
34+
RESPONSE_BODY=${CURL_OUTPUT%STATUS_CODE:*}
35+
36+
ACCOUNT_TYPE="ACCOUNT"
37+
38+
if [ "$HTTP_CODE" == "200" ] && echo "$RESPONSE_BODY" | grep -q '"enterprise_id"'; then
39+
ACCOUNT_TYPE="ENTERPRISE"
40+
fi
41+
42+
echo "{\"account_type\": \"${ACCOUNT_TYPE}\"}"
43+
44+
exit 0

‎tests/other_tests.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ func setupOptions(t *testing.T, prefix string, dir string) *testhelper.TestOptio
1717
TerraformDir: dir,
1818
Prefix: prefix,
1919
CheckApplyResultForUpgrade: true,
20+
IgnoreAdds: testhelper.Exemptions{
21+
List: []string{"module.scc_wp.restapi_object.cspm"},
22+
},
2023
})
2124
return options
2225
}

‎tests/pr_test.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,8 @@ func TestFullyConfigurable(t *testing.T) {
103103
Prefix: "wp-da",
104104
TarIncludePatterns: []string{
105105
"*.tf",
106+
"modules/*/*.tf",
107+
"modules/*/*.sh",
106108
fullyConfigurableDADir + "/*.tf",
107109
},
108110
ResourceGroup: resourceGroup,
@@ -192,6 +194,8 @@ func TestFullyConfigurableUpgrade(t *testing.T) {
192194
Prefix: "wp-da",
193195
TarIncludePatterns: []string{
194196
"*.tf",
197+
"modules/*/*.tf",
198+
"modules/*/*.sh",
195199
fullyConfigurableDADir + "/*.tf",
196200
},
197201
ResourceGroup: resourceGroup,

0 commit comments

Comments
 (0)