terraform-ibm-modules · maheshwarishikha · Sep 30, 2025 · Jul 10, 2025 · Jul 11, 2025 · Jul 14, 2025
diff --git a/common-dev-assets b/common-dev-assets
@@ -27,15 +27,15 @@
       "provider_name": "IBM",
       "features": [
         {
-          "title": "Configures Internet Service DNS",
+          "title": "Internet Service DNS",
           "description": "Configures Internet Service DNS."
         },
         {
-          "title": "Creates Secrets Manager Internet Service authorization",
+          "title": "Secrets Manager Internet Service authorization",
           "description": "Creates authorization between Secrets Manager and Internet Service."
         },
         {
-          "title": "Configures Let's Encrypt certificate authority",
+          "title": "Let's Encrypt certificate authority",
           "description": "Configures Let's Encrypt certificate authority."
         }
       ],
@@ -75,29 +75,74 @@
           },
           "iam_permissions": [
             {
-              "service_name": "iam-access-groups",
               "role_crns": [
                 "crn:v1:bluemix:public:iam::::role:Editor"
-              ]
+              ],
+              "service_name": "iam-access-groups",
+              "notes": "[optional] Required for managing IAM access groups."
             },
             {
-              "service_name": "iam-identity",
               "role_crns": [
-                "crn:v1:bluemix:public:iam::::role:Operator"
-              ]
+                "crn:v1:bluemix:public:iam::::role:Operator",
+                "crn:v1:bluemix:public:iam::::role:Administrator"
+              ],
+              "service_name": "iam-identity",
+              "notes":"[Optional] Required for Cloud automation for account configuration is enabled."
             },
             {
-              "service_name": "resource-group",
               "role_crns": [
                 "crn:v1:bluemix:public:iam::::role:Viewer"
-              ]
+              ],
+              "service_name": "resource-group",
+              "notes":"Viewer access is required in the resource group you want to provision in."
             },
             {
-              "service_name": "secrets-manager",
               "role_crns": [
                 "crn:v1:bluemix:public:iam::::serviceRole:Administrator",
                 "crn:v1:bluemix:public:iam::::serviceRole:Manager"
-              ]
+              ],
+              "service_name": "secrets-manager",
+              "notes": "[optional] Required for creating an Secrets Manager instance."
+            },
+            {
+              "role_crns": [
+                "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+                "crn:v1:bluemix:public:iam::::role:Editor"
+              ],
+              "service_name": "event-notifications",
+              "notes": "[Optional] Required if you are configuring an Event Notifications Instance."
+            },
+            {
+              "role_crns": [
+                "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+                "crn:v1:bluemix:public:iam::::role:Editor"
+              ],
+              "service_name": "sysdig-monitor",
+              "notes": "[Optional] Required if you are consuming the Observability deployable architecture which sets up Cloud Monitoring."
+            },
+            {
+              "role_crns": [
+                "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+                "crn:v1:bluemix:public:iam::::role:Editor"
+              ],
+              "service_name": "logs",
+              "notes": "[Optional] Required if you are consuming the Observability deployable architecture which sets up Cloud Logs."
+            },
+            {
+              "role_crns": [
+                "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+                "crn:v1:bluemix:public:iam::::role:Editor"
+              ],
+              "service_name": "hs-crypto",
+              "notes": "[Optional] Required if you are creating/configuring keys in an existing Hyper Protect Crypto Services (HPCS) instance for encryption."
+            },
+            {
+              "role_crns": [
+                "crn:v1:bluemix:public:iam::::serviceRole:Manager",
+                "crn:v1:bluemix:public:iam::::role:Editor"
+              ],
+              "service_name": "kms",
+              "notes": "[Optional] Required if you are creating/configuring Key Protect instance and keys for encryption."
             }
           ],
           "configuration": [

@@ -1,10 +1,3 @@
-# Secrets Manager Public Certificate Engine
+# Cloud automation for Secrets Manager Public Certificate Engine (Fully configurable)
 
-This solution supports the following:
-- Provisioning a Secrets Manager public certificate authority configuration to configure Let's Encrypt as a Certificate Authority (CA).
-- Provisioning a Secrets Manager DNS provider configuration for IBM Cloud Internet Services.
-- Provisioning a Secrets Manager to Cloud Internet Service authorization policy.
-
-![secrets-manager-public-cert-engine-deployable-architecture](../../reference-architecture/secrets_manager_public_cert_engine.svg)
-
-**NB:** This solution is not intended to be invoked by other modules, as it includes provider configuration. As a result, it is incompatible with the `for_each`, `count`, and `depends_on` arguments. For more information see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers)
+:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).
@@ -1,7 +1,8 @@
 provider "ibm" {
-  ibmcloud_api_key = var.ibmcloud_api_key
-  region           = local.existing_secrets_manager_region
-  visibility       = var.provider_visibility
+  ibmcloud_api_key      = var.ibmcloud_api_key
+  region                = local.existing_secrets_manager_region
+  visibility            = var.provider_visibility
+  private_endpoint_type = (var.provider_visibility == "private" && local.existing_secrets_manager_region == "ca-mon") ? "vpe" : null
 }
 
 provider "ibm" {
+1 −1		examples/Dockerfile
+1 −1		module-assets/.pre-commit-config.yaml
+1 −1		module-assets/ci/install-deps.sh
+0 −16		module-assets/ci/run-tests.sh
+1 −1		stack-assets/.pre-commit-config.yaml
+1 −1		stack-assets/stack-updater/requirements.txt