|
1 | 1 | <!-- BEGIN MODULE HOOK --> |
2 | 2 |
|
3 | 3 | <!-- Update the title to match the module name and add a description --> |
4 | | -# Terraform Modules Template Project |
5 | | -<!-- UPDATE BADGE: Update the link for the following badge--> |
6 | | -[-red)](https://terraform-ibm-modules.github.io/documentation/#/badge-status) |
7 | | -[](https://github.com/terraform-ibm-modules/terraform-ibm-module-template/actions/workflows/ci.yml) |
| 4 | +# Secrets Manager Private Cert module |
| 5 | +[-yellowgreen?style=plastic)](https://terraform-ibm-modules.github.io/documentation/#/badge-status) |
| 6 | +[](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-private-cert/actions/workflows/ci.yml) |
8 | 7 | [](https://github.com/pre-commit/pre-commit) |
9 | | -[](https://github.com/terraform-ibm-modules/terraform-ibm-module-template/releases/latest) |
| 8 | +[](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-private-cert/releases/latest) |
10 | 9 | [](https://renovatebot.com/) |
11 | 10 | [](https://github.com/semantic-release/semantic-release) |
12 | 11 |
|
13 | | -<!-- Remove the content in this H2 heading after completing the steps --> |
| 12 | +This module creates a private certificate in an existing Secrets Manager instance that has a configured [Private Certificate Engine](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-certificates&interface=ui). |
14 | 13 |
|
15 | | -## Submit a new module |
16 | | - |
17 | | -:+1::tada: Thank you for taking the time to contribute! :tada::+1: |
18 | | - |
19 | | -This template repository exists to help you create Terraform modules for IBM Cloud. |
20 | | - |
21 | | -The default structure includes the following files: |
22 | | - |
23 | | -- `README.md`: A description of the module |
24 | | -- `main.tf`: The logic for the module |
25 | | -- `version.tf`: The required terraform and provider versions |
26 | | -- `variables.tf`: The input variables for the module |
27 | | -- `outputs.tf`: The values that are output from the module |
28 | | -For more information, see [Module structure](https://terraform-ibm-modules.github.io/documentation/#/module-structure) in the project documentation. |
29 | | - |
30 | | -You can add other content to support what your module does and how it works. For example, you might add a `scripts/` directory that contains shell scripts that are run by a `local-exec` `null_resource` in the Terraform module. |
31 | | - |
32 | | -Follow this process to create and submit a Terraform module. |
33 | | - |
34 | | -### Create a repo from this repo template |
35 | | - |
36 | | -1. Create a repository from this repository template by clicking `Use this template` in the upper right of the GitHub UI. |
37 | | -    <br>For more information about creating a repository from a template, see the [GitHub docs](https://docs.github.com/en/repositories/creating-and-managing-repositories/creating-a-repository-from-a-template). |
38 | | -1. Select `terraform-ibm-modules` as the owner. |
39 | | -1. Enter a name for the module in format `terraform-ibm-<NAME>`, where `<NAME>` reflects the type of infrastructure that the module manages. |
40 | | -    <br>Use hyphens as delimiters for names with multiple words (for example, terraform-ibm-`activity-tracker`). |
41 | | -1. Provide a short description of the module. |
42 | | -    <br>The description is displayed under the repository name on the [organization page](https://github.com/terraform-ibm-modules) and in the **About** section of the repository. Use the description to help users understand the purpose of your module. For more information, see [module names and descriptions](https://terraform-ibm-modules.github.io/documentation/#/implementation-guidelines?id=module-names-and-descriptions) in the docs. |
43 | | - |
44 | | -### Clone the repo and set up your development environment |
45 | | - |
46 | | -Locally clone the new repository and set up your development environment by completing the tasks in [Local development setup](https://terraform-ibm-modules.github.io/documentation/#/local-dev-setup) in the project documentation. |
47 | | - |
48 | | -### Update the repo name and description in source control |
49 | | - |
50 | | -To help make sure that the repo name and description are not changed except through pull requests, they are defined in the `settings.yml` file. |
51 | | - |
52 | | -Check to make sure that values are uncommented and correct: |
53 | | - |
54 | | -1. Open the [settings.yml](.github/settings.yml) file. |
55 | | -1. If not already updated, uncomment the `name` and `description` properties and set the values to what you specified when you requested the repo. |
56 | | - |
57 | | -### Update the Terraform files |
58 | | - |
59 | | -Implement the logic for your module by updating the `main.tf`, `version.tf`, `variables.tf`, and `outputs.tf` Terraform files. For more information, see [Creating Terraform on IBM Cloud templates](https://cloud.ibm.com/docs/ibm-cloud-provider-for-terraform?topic=ibm-cloud-provider-for-terraform-create-tf-config). |
60 | | - |
61 | | -### Create examples and tests |
62 | | - |
63 | | -Add one or more examples in the `examples` directory that consume your new module, and configure tests for them in the `tests` directory. For more information about tests, see [Tests](https://terraform-ibm-modules.github.io/documentation/#/tests). |
64 | | - |
65 | | -### Update the content in the readme file |
66 | | - |
67 | | -After you implement the logic for your module and create examples and tests, update this readme file in your repository by following these steps: |
68 | | - |
69 | | -1. Update the title heading and add a description about your module. |
70 | | -1. Update the badge links. |
71 | | -1. Remove all the content in this H2 heading section. |
72 | | -1. Complete the [Usage](#usage) and [Required IAM access policies](#required-iam-access-policies) sections. The [Examples](#examples) and [Requirements](#requirements) section are populated by a pre-commit hook. |
73 | | - |
74 | | -### Commit your code and submit your module for review |
75 | | - |
76 | | -1. Before you commit any code, review [Contributing to the IBM Cloud Terraform modules project](https://terraform-ibm-modules.github.io/documentation/#/contribute-module) in the project documentation. |
77 | | -1. Create a pull request for review. |
78 | | - |
79 | | -### Post-merge steps |
80 | | - |
81 | | -After the first PR for your module is merged, follow these post-merge steps: |
82 | | - |
83 | | -1. Create a PR to enable the upgrade test by removing the `t.Skip` line in `tests/pr_test.go`. |
84 | | - |
85 | | -<!-- Remove the content in this previous H2 heading --> |
86 | | -## Reference architectures |
87 | | - |
88 | | -<!-- |
89 | | -Add links to any reference architectures for this module. |
90 | | -(Usually in the `/reference-architectures` directory.) |
91 | | -See "Reference architecture" in Authoring Guidelines in the public documentation at |
92 | | -https://terraform-ibm-modules.github.io/documentation/#/implementation-guidelines?id=reference-architecture |
93 | | ---> |
| 14 | +The module handles the following resource: |
| 15 | +- Secrets Manager private certificate |
94 | 16 |
|
95 | 17 | ## Usage |
96 | 18 |
|
97 | | -<!-- |
98 | | -Add an example of the use of the module in the following code block. |
99 | | -
|
100 | | -Use real values instead of "var.<var_name>" or other placeholder values |
101 | | -unless real values don't help users know what to change. |
102 | | ---> |
103 | | - |
104 | 19 | ```hcl |
105 | | -
|
| 20 | +# Replace "main" with a GIT release version to lock into a specific release |
| 21 | +module "secrets_manager_private_certificate" { |
| 22 | + source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-private-cert?ref=main" |
| 23 | +
|
| 24 | + cert_name = "example-private-cert" |
| 25 | + cert_description = "an example private cert" |
| 26 | + cert_secrets_group_id = "the secret group ID to place the cert" |
| 27 | + cert_template = "name of the cert template to use" |
| 28 | + cert_common_name = "example.com" |
| 29 | +
|
| 30 | + secrets_manager_guid = module.secrets_manager.secrets_manager_guid |
| 31 | + secrets_manager_region = var.region |
| 32 | +} |
106 | 33 | ``` |
107 | 34 |
|
108 | 35 | ## Required IAM access policies |
109 | 36 |
|
110 | | -<!-- PERMISSIONS REQUIRED TO RUN MODULE |
111 | | -If this module requires permissions, uncomment the following block and update |
112 | | -the sample permissions, following the format. |
113 | | -Replace the sample Account and IBM Cloud service names and roles with the |
114 | | -information in the console at |
115 | | -Manage > Access (IAM) > Access groups > Access policies. |
116 | | ---> |
117 | | - |
118 | | -<!-- |
119 | 37 | You need the following permissions to run this module. |
120 | 38 |
|
121 | 39 | - Account Management |
122 | | - - **Sample Account Service** service |
123 | | - - `Editor` platform access |
124 | | - - `Manager` service access |
125 | | - - IAM Services |
126 | | - - **Sample Cloud Service** service |
127 | | - - `Administrator` platform access |
128 | | ---> |
129 | | - |
130 | | -<!-- NO PERMISSIONS FOR MODULE |
131 | | -If no permissions are required for the module, uncomment the following |
132 | | -statement instead the previous block. |
133 | | ---> |
134 | | - |
135 | | -<!-- No permissions are needed to run this module.--> |
| 40 | + - **IAM Access Groups** service |
| 41 | + - `Editor` platform access |
| 42 | + - **IAM Identity** service |
| 43 | + - `Operator` platform access |
| 44 | + - **Resource Group** service |
| 45 | + - `Viewer` platform access |
| 46 | +- IAM Services |
| 47 | + - **Secrets Manager** service |
| 48 | + - `Administrator` platform access |
| 49 | + - `Manager` service access |
| 50 | + |
136 | 51 | <!-- END MODULE HOOK --> |
137 | 52 | <!-- BEGIN EXAMPLES HOOK --> |
138 | 53 | ## Examples |
139 | 54 |
|
140 | 55 | - [ Default example](examples/default) |
141 | | -- [ Example that uses existing resources](examples/existing-resources) |
142 | | -- [ Non default example](examples/non-default) |
143 | 56 | <!-- END EXAMPLES HOOK --> |
144 | 57 | <!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
145 | 58 | ## Requirements |
146 | 59 |
|
147 | 60 | | Name | Version | |
148 | 61 | |------|---------| |
149 | | -| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.0 | |
| 62 | +| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 | |
| 63 | +| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.51.0 | |
150 | 64 |
|
151 | 65 | ## Modules |
152 | 66 |
|
153 | 67 | No modules. |
154 | 68 |
|
155 | 69 | ## Resources |
156 | 70 |
|
157 | | -No resources. |
| 71 | +| Name | Type | |
| 72 | +|------|------| |
| 73 | +| [ibm_sm_private_certificate.secrets_manager_private_certificate](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/sm_private_certificate) | resource | |
158 | 74 |
|
159 | 75 | ## Inputs |
160 | 76 |
|
161 | | -No inputs. |
| 77 | +| Name | Description | Type | Default | Required | |
| 78 | +|------|-------------|------|---------|:--------:| |
| 79 | +| <a name="input_cert_alt_names"></a> [cert\_alt\_names](#input\_cert\_alt\_names) | Optional, Alternate names for the certificate to be created | `list(string)` | `null` | no | |
| 80 | +| <a name="input_cert_common_name"></a> [cert\_common\_name](#input\_cert\_common\_name) | Fully qualified domain name or host domain name for the certificate to be created | `string` | n/a | yes | |
| 81 | +| <a name="input_cert_csr"></a> [cert\_csr](#input\_cert\_csr) | Certificate signing request. If you don't include this parameter, the CSR that is used to generate the certificate is created internally | `string` | `null` | no | |
| 82 | +| <a name="input_cert_custom_metadata"></a> [cert\_custom\_metadata](#input\_cert\_custom\_metadata) | Optional, Custom metadata for the certificate to be created | `map(string)` | <pre>{<br> "collection_total": 1,<br> "collection_type": "application/vnd.ibm.secrets-manager.secret+json"<br>}</pre> | no | |
| 83 | +| <a name="input_cert_description"></a> [cert\_description](#input\_cert\_description) | Optional, Extended description of certificate to be created. To protect privacy, do not use personal data, such as name or location, as a description for certificate | `string` | `null` | no | |
| 84 | +| <a name="input_cert_ip_sans"></a> [cert\_ip\_sans](#input\_cert\_ip\_sans) | Optional, IP Subject Alternative Names (SANs) to define for the CA certificate, in a comma-delimited list | `string` | `null` | no | |
| 85 | +| <a name="input_cert_labels"></a> [cert\_labels](#input\_cert\_labels) | Optional, Labels for the certificate to be created | `list(string)` | `[]` | no | |
| 86 | +| <a name="input_cert_name"></a> [cert\_name](#input\_cert\_name) | Name of the certificate to be created in Secrets Manager | `string` | n/a | yes | |
| 87 | +| <a name="input_cert_other_sans"></a> [cert\_other\_sans](#input\_cert\_other\_sans) | Optional, The custom Object Identifier (OID) or UTF8-string Subject Alternative Names (SANs) to define for the CA certificate. The alternative names must match the values that are specified in the 'allowed\_other\_sans' field in the associated certificate template | `list(string)` | `[]` | no | |
| 88 | +| <a name="input_cert_rotation"></a> [cert\_rotation](#input\_cert\_rotation) | Optional, Rotation policy for the certificate to be created | <pre>object({<br> auto_rotate = optional(bool)<br> interval = optional(number)<br> unit = optional(string)<br> })</pre> | <pre>{<br> "auto_rotate": true,<br> "interval": 1,<br> "unit": "month"<br>}</pre> | no | |
| 89 | +| <a name="input_cert_secrets_group_id"></a> [cert\_secrets\_group\_id](#input\_cert\_secrets\_group\_id) | Optional, Id of Secrets Manager secret group to store the certificate in | `string` | `"default"` | no | |
| 90 | +| <a name="input_cert_template"></a> [cert\_template](#input\_cert\_template) | Name of the certificate template to use | `string` | n/a | yes | |
| 91 | +| <a name="input_cert_ttl"></a> [cert\_ttl](#input\_cert\_ttl) | Optional, Time-to-live (TTL) to assign to a private certificate | `string` | `null` | no | |
| 92 | +| <a name="input_cert_uri_sans"></a> [cert\_uri\_sans](#input\_cert\_uri\_sans) | Optional, URI Subject Alternative Names (SANs) to define for the CA certificate, in a comma-delimited list | `string` | `null` | no | |
| 93 | +| <a name="input_cert_version_custom_metadata"></a> [cert\_version\_custom\_metadata](#input\_cert\_version\_custom\_metadata) | Optional, Custom version metadata for the certificate to be created | `map(string)` | `{}` | no | |
| 94 | +| <a name="input_exclude_cn_from_sans"></a> [exclude\_cn\_from\_sans](#input\_exclude\_cn\_from\_sans) | Optional, Controls whether the common name is excluded from Subject Alternative Names (SANs). If set to true, the common name is not included in DNS or Email SANs if they apply | `bool` | `false` | no | |
| 95 | +| <a name="input_private_key_format"></a> [private\_key\_format](#input\_private\_key\_format) | Optional, Format of the generated private key | `string` | `"der"` | no | |
| 96 | +| <a name="input_return_format"></a> [return\_format](#input\_return\_format) | Optional, Format of the returned data | `string` | `"pem"` | no | |
| 97 | +| <a name="input_secrets_manager_guid"></a> [secrets\_manager\_guid](#input\_secrets\_manager\_guid) | Secrets Manager GUID | `string` | n/a | yes | |
| 98 | +| <a name="input_secrets_manager_region"></a> [secrets\_manager\_region](#input\_secrets\_manager\_region) | Region the Secrets Manager instance is in | `string` | n/a | yes | |
| 99 | +| <a name="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints) | Service endpoint type to communicate with the provided secrets manager instance. Possible values are `public` or `private` | `string` | `"public"` | no | |
162 | 100 |
|
163 | 101 | ## Outputs |
164 | 102 |
|
165 | | -No outputs. |
| 103 | +| Name | Description | |
| 104 | +|------|-------------| |
| 105 | +| <a name="output_secret_crn"></a> [secret\_crn](#output\_secret\_crn) | Private certificates secrets manager secret CRN | |
| 106 | +| <a name="output_secret_id"></a> [secret\_id](#output\_secret\_id) | Private certificates secrets manager secret ID | |
166 | 107 | <!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK --> |
167 | 108 | <!-- BEGIN CONTRIBUTING HOOK --> |
168 | 109 |
|
|
0 commit comments