diff --git a/ibm_catalog.json b/ibm_catalog.json
index 86f5aa2..d3c55d0 100644
--- a/ibm_catalog.json
+++ b/ibm_catalog.json
@@ -20,108 +20,149 @@
"terraform",
"solution"
],
- "short_description": "Creates and configures a Secrets Manager Public Certificates Engine.",
- "long_description": "This deployable architecture is used to configure an Internet Service DNS configuration, establish authorization between Secrets Manager and the Internet Service, and set up Let's Encrypt as the certificate authority. This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) asset collection, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [Automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
+ "short_description": "Creates and configures a Secrets Manager public certificates engine",
+ "long_description": "This deployable architecture sets up a public certificates engine in IBM Cloud Secrets Manager, enabling automated provisioning and management of publicly trusted Transport Layer Security (TLS) certificates. These certificates are issued by Let’s Encrypt, a widely trusted Certificate Authority (CA) that helps secure websites and applications with HTTPS. This deployable architecture configures integration between IBM Cloud Secrets Manager, Cloud Internet Services (CIS) for Domain Name System (DNS) validation, and Let’s Encrypt as the Certificate Authority (CA). It provisions the required authorization policies, DNS configuration, and CA configuration so that applications can obtain and renew public certificates automatically.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.",
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/blob/main/README.md",
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/main/images/secrets_manager_public_cert_engine.svg",
"provider_name": "IBM",
"features": [
{
- "title": "Configures Internet Service DNS",
- "description": "Configures Internet Service DNS."
+ "title": "DNS configuration in Internet Services",
+ "description": "Adds DNS configuration in Internet Services for domain validation when ordering certificates. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-dns-provider&interface=ui)."
},
{
- "title": "Creates Secrets Manager Internet Service authorization",
- "description": "Creates authorization between Secrets Manager and Internet Service."
+ "title": "Service-to-Service Authorization",
+ "description": "Creates [authorization](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-prepare-order-certificates#authorize-cis) between the Secrets Manager and Internet Services."
},
{
- "title": "Configures Let's Encrypt certificate authority",
- "description": "Configures Let's Encrypt certificate authority."
+ "title": "Certificate Authority",
+ "description": "Configures Let's Encrypt certificate authority for getting the SSL/TLS certificates approved. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-add-certificate-authority&interface=terraform)."
}
],
- "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/issues](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/issues). Please note this product is not supported via the IBM Cloud Support Center.",
+ "support_details": "This product is in the community registry, as such support is handled through the [original repo](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine). If you experience issues please open an issue [here](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/issues). Please note this product is not supported via the IBM Cloud Support Center.",
"flavors": [
{
"label": "Fully configurable",
"name": "fully-configurable",
+ "index": 1,
"install_type": "fullstack",
"working_directory": "solutions/fully-configurable",
"architecture": {
- "descriptions": "This architecture supports creating and configuring a Secrets Manager Public Certificates Engine.",
"features": [
{
- "title": "Internet Service DNS",
- "description": "Configures Internet Service DNS configuration."
- },
- {
- "title": "Authorization between Secrets Manager and Internet Service",
- "description": "Creates authorization between Secrets Manager and Internet Service."
- },
- {
- "title": "Let's Encrypt certificate authority",
- "description": "Provisions a Let's Encrypt certificate authority."
+ "title": " ",
+ "description": "Configured to use IBM secure-by-default standards, but can be edited to fit your use case."
}
],
"diagrams": [
{
"diagram": {
"caption": "Secrets Manager Public Certificates Engine",
- "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/main/reference-architecture/secrets_manager_public_cert_engine.svg",
+ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager-public-cert-engine/main/reference-architecture/deployable-architecture-sm-public-cert-engine.svg",
"type": "image/svg+xml"
},
- "description": "This architcture supports creating secrets manager public certificates engine within a secrets manager instance."
+ "description": "This architecture supports creating a Secrets Manager public certificates engine within a Secrets Manager instance. The Secrets Manager public certificates engine enables you to issue and manage publicly trusted TLS/SSL certificates by integrating with external Certificate Authorities such as Let's Encrypt. It supports configuring DNS providers like IBM Cloud Internet Services (CIS) for domain validation, managing CA configurations, and automating the issuance and renewal of public certificates for internet-facing applications and services."
}
]
},
"iam_permissions": [
{
- "service_name": "iam-access-groups",
"role_crns": [
"crn:v1:bluemix:public:iam::::role:Editor"
- ]
+ ],
+ "service_name": "iam-groups",
+ "notes": "[Optional] Required for managing IAM access groups."
},
{
- "service_name": "iam-identity",
"role_crns": [
- "crn:v1:bluemix:public:iam::::role:Operator"
- ]
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "All Account Management services",
+ "notes": "[Optional] Required to create new resource groups when enabling the Account Configuration integration."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::role:Administrator"
+ ],
+ "service_name": "All Identity and Access enabled services",
+ "notes": "[Optional] Required to create new resource groups with account settings when enabling the Account Configuration integration."
},
{
- "service_name": "resource-group",
"role_crns": [
"crn:v1:bluemix:public:iam::::role:Viewer"
- ]
+ ],
+ "service_name": "Resource group only",
+ "notes": "Viewer access is required in the resource group you want to provision in."
},
{
- "service_name": "secrets-manager",
"role_crns": [
- "crn:v1:bluemix:public:iam::::serviceRole:Administrator",
+ "crn:v1:bluemix:public:iam::::role:Editor",
"crn:v1:bluemix:public:iam::::serviceRole:Manager"
- ]
+ ],
+ "service_name": "secrets-manager",
+ "notes": "Required to create a Secrets Manager instance."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "event-notifications",
+ "notes": "[Optional] Required to create an Event Notifications instance."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "sysdig-monitor",
+ "notes": "[Optional] Required to create an instance of Cloud Monitoring."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Writer",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "atracker",
+ "notes": "[Optional] Required when enabling the Activity Tracker Event Routing."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "cloud-object-storage",
+ "notes": "[Optional] Required to create Object Storage instance."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "logs",
+ "notes": "[Optional] Required to create an instance of Cloud Logs."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "hs-crypto",
+ "notes": "[Optional] Required if Hyper Protect Crypto Service is used for encryption."
+ },
+ {
+ "role_crns": [
+ "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+ "crn:v1:bluemix:public:iam::::role:Editor"
+ ],
+ "service_name": "kms",
+ "notes": "[Optional] Required if Key Protect is used for encryption."
}
],
"configuration": [
{
"key": "ibmcloud_api_key"
},
- {
- "key": "provider_visibility",
- "options": [
- {
- "displayname": "private",
- "value": "private"
- },
- {
- "displayname": "public",
- "value": "public"
- },
- {
- "displayname": "public-and-private",
- "value": "public-and-private"
- }
- ],
- "hidden": true
- },
{
"key": "existing_secrets_manager_crn",
"required": true
@@ -135,7 +176,7 @@
"required": true,
"virtual": true,
"default_value": "us-south",
- "description": "The region to provision a new Secrets Manager instance in.",
+ "description": "The region to provision a Secrets Manager instance.",
"options": [
{
"displayname": "Osaka (jp-osa)",
@@ -201,6 +242,10 @@
"default_value": "standard",
"description": "The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard)."
},
+ {
+ "key": "service_endpoints",
+ "hidden": true
+ },
{
"key": "ibmcloud_cis_api_key"
},
@@ -241,12 +286,30 @@
},
{
"key": "skip_iam_authorization_policy"
+ },
+ {
+ "key": "provider_visibility",
+ "options": [
+ {
+ "displayname": "private",
+ "value": "private"
+ },
+ {
+ "displayname": "public",
+ "value": "public"
+ },
+ {
+ "displayname": "public-and-private",
+ "value": "public-and-private"
+ }
+ ],
+ "hidden": true
}
],
"dependencies": [
{
"name": "deploy-arch-ibm-secrets-manager",
- "description": "Create a new Secrets Manager instance.",
+ "description": "Configure Secrets Manager to deploy public certificates engine.",
"id": "6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global",
"version": "v2.8.6",
"flavors": [
diff --git a/reference-architecture/deployable-architecture-sm-public-cert-engine.svg b/reference-architecture/deployable-architecture-sm-public-cert-engine.svg
new file mode 100644
index 0000000..c9f57c7
--- /dev/null
+++ b/reference-architecture/deployable-architecture-sm-public-cert-engine.svg
@@ -0,0 +1,4 @@
+
+
+
+
\ No newline at end of file
diff --git a/reference-architecture/secrets_manager_public_cert_engine.svg b/reference-architecture/secrets_manager_public_cert_engine.svg
deleted file mode 100644
index 54a6c8a..0000000
--- a/reference-architecture/secrets_manager_public_cert_engine.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-
-
-
-
\ No newline at end of file
diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md
index 7dd6209..3ec3c98 100644
--- a/solutions/fully-configurable/README.md
+++ b/solutions/fully-configurable/README.md
@@ -1,10 +1,3 @@
-# Secrets Manager Public Certificate Engine
+# Cloud automation for Secrets Manager public certificates engine (Fully configurable)
-This solution supports the following:
-- Provisioning a Secrets Manager public certificate authority configuration to configure Let's Encrypt as a Certificate Authority (CA).
-- Provisioning a Secrets Manager DNS provider configuration for IBM Cloud Internet Services.
-- Provisioning a Secrets Manager to Cloud Internet Service authorization policy.
-
-
-
-**NB:** This solution is not intended to be invoked by other modules, as it includes provider configuration. As a result, it is incompatible with the `for_each`, `count`, and `depends_on` arguments. For more information see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers)
+:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).
diff --git a/solutions/fully-configurable/main.tf b/solutions/fully-configurable/main.tf
index a2d2db0..b35d0a9 100644
--- a/solutions/fully-configurable/main.tf
+++ b/solutions/fully-configurable/main.tf
@@ -44,7 +44,7 @@ module "secrets_manager_public_cert_engine" {
ca_config_name = "${local.prefix}${var.ca_config_name}"
lets_encrypt_environment = var.lets_encrypt_environment
acme_letsencrypt_private_key = var.acme_letsencrypt_private_key
- service_endpoints = "private"
+ service_endpoints = var.service_endpoints
skip_iam_authorization_policy = var.skip_iam_authorization_policy
private_key_secrets_manager_instance_guid = local.existing_secrets_manager_guid
private_key_secrets_manager_secret_id = local.secret_id
diff --git a/solutions/fully-configurable/provider.tf b/solutions/fully-configurable/provider.tf
index 0a287e9..e3b154e 100644
--- a/solutions/fully-configurable/provider.tf
+++ b/solutions/fully-configurable/provider.tf
@@ -1,7 +1,8 @@
provider "ibm" {
- ibmcloud_api_key = var.ibmcloud_api_key
- region = local.existing_secrets_manager_region
- visibility = var.provider_visibility
+ ibmcloud_api_key = var.ibmcloud_api_key
+ region = local.existing_secrets_manager_region
+ visibility = var.provider_visibility
+ private_endpoint_type = (var.provider_visibility == "private" && local.existing_secrets_manager_region == "ca-mon") ? "vpe" : null
}
provider "ibm" {
diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf
index c4bf47d..c08ddbc 100644
--- a/solutions/fully-configurable/variables.tf
+++ b/solutions/fully-configurable/variables.tf
@@ -47,6 +47,11 @@ variable "prefix" {
}
}
+variable "service_endpoints" {
+ type = string
+ description = "The service endpoint type to communicate with the provided secrets manager instance."
+ default = "private"
+}
variable "ibmcloud_cis_api_key" {
type = string
@@ -75,7 +80,7 @@ variable "internet_service_domain_id" {
variable "dns_config_name" {
type = string
- description = "Name of the DNS config for the public_cert secrets engine. If passing a value for `dns_config_name` a value for `internet_services_crn` is required. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli#secrets-manager-configurations-cli)."
+ description = "Name of the DNS config for the Public Certificates Secrets Engine. If passing a value for `dns_config_name` a value for `internet_services_crn` is required. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli#secrets-manager-configurations-cli)."
default = null
validation {
@@ -92,7 +97,7 @@ variable "ca_config_name" {
variable "lets_encrypt_environment" {
type = string
- description = "Let's Encrypt environment (staging, production). [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli#secrets-manager-configurations-cli)."
+ description = "The configuration of the Let's Encrypt Certificate Authority environment. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secrets-manager-cli#secrets-manager-configurations-cli)."
default = "production"
validation {
diff --git a/tests/pr_test.go b/tests/pr_test.go
index edf9ca5..5e974a9 100644
--- a/tests/pr_test.go
+++ b/tests/pr_test.go
@@ -151,7 +151,7 @@ func TestRunSolutionsFullyConfigurableUpgradeSchematics(t *testing.T) {
{Name: "prefix", Value: options.Prefix, DataType: "string"},
{Name: "existing_secrets_manager_crn", Value: permanentResources["secretsManagerCRN"], DataType: "string"},
{Name: "acme_letsencrypt_private_key_secrets_manager_secret_crn", Value: permanentResources["acme_letsencrypt_private_key_secret_crn"], DataType: "string"},
- {Name: "dns_config_name", Value: "cer-dns", DataType: "string"},
+ {Name: "dns_config_name", Value: "cert-dns", DataType: "string"},
{Name: "internet_services_crn", Value: permanentResources["cisInstanceId"], DataType: "string"},
{Name: "skip_iam_authorization_policy", Value: true, DataType: "bool"}, // A permanent cis-sm auth policy already exists in the account
}