Skip to content

Commit 5e82ff5

Browse files
Aayush-AbhyarthiAayush-Abhyarthi
authored
feat: initial release (#3)
1 parent b5693b6 commit 5e82ff5

21 files changed

+1026
-305
lines changed

‎README.md‎

Lines changed: 119 additions & 132 deletions
Large diffs are not rendered by default.

‎cra-config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "examples/basic" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "examples/complete" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
66
# CRA_ENVIRONMENT_VARIABLES: # An optional map of environment variables for CRA, where the key is the variable name and value is the value. Useful for providing TF_VARs.
77
# TF_VAR_sample: "sample value"

‎examples/basic/README.md‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎examples/basic/main.tf‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎examples/basic/outputs.tf‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

‎examples/basic/provider.tf‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎examples/basic/variables.tf‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎examples/basic/version.tf‎

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎examples/complete/README.md‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,8 @@
1-
# Complete example
1+
# Example creating arbitrary, username_password and imported_cert type secrets
22

3-
<!-- There is a pre-commit hook that will take the title of each example add include it in the repos main README.md -->
4-
<!-- Add text below should describe exactly what resources are provisioned / configured by the example -->
3+
- Creates new secrets-manager instance (if existing instance GUID not passed in)
4+
- Creates new secret group
5+
- Creates an arbitrary type secret in the secret group
6+
- Creates a username_password type secret in the secret group
7+
- Creates a TLS cert, and adds it to secrets manager as an imported_cert secret type in the secret group
8+
- Retrieves metadata for all the secrets created

‎examples/complete/main.tf‎

Lines changed: 192 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,194 @@
11
##############################################################################
2-
# Complete example
2+
# Local variables + validation
33
##############################################################################
4+
5+
locals {
6+
payload = sensitive("secret-payload-example")
7+
validate_sm_region_cnd = var.existing_sm_instance_guid != null && var.existing_sm_instance_region == null
8+
validate_sm_region_msg = "existing_sm_instance_region must also be set when value given for existing_sm_instance_guid."
9+
# tflint-ignore: terraform_unused_declarations
10+
validate_sm_region_chk = regex(
11+
"^${local.validate_sm_region_msg}$",
12+
(!local.validate_sm_region_cnd
13+
? local.validate_sm_region_msg
14+
: ""))
15+
16+
sm_guid = var.existing_sm_instance_guid == null ? ibm_resource_instance.secrets_manager[0].guid : var.existing_sm_instance_guid
17+
sm_region = var.existing_sm_instance_region == null ? var.region : var.existing_sm_instance_region
18+
19+
secret_labels = [var.prefix, var.region]
20+
}
21+
22+
##############################################################################
23+
# Resource Group
24+
##############################################################################
25+
26+
module "resource_group" {
27+
source = "terraform-ibm-modules/resource-group/ibm"
28+
version = "1.0.5"
29+
# if an existing resource group is not set (null) create a new one using prefix
30+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
31+
existing_resource_group_name = var.resource_group
32+
}
33+
34+
##############################################################################
35+
# Secrets Manager
36+
##############################################################################
37+
38+
resource "ibm_resource_instance" "secrets_manager" {
39+
count = var.existing_sm_instance_guid == null ? 1 : 0
40+
name = "${var.prefix}-sm-instance"
41+
service = "secrets-manager"
42+
plan = var.sm_service_plan
43+
location = var.region
44+
resource_group_id = module.resource_group.resource_group_id
45+
tags = var.resource_tags
46+
timeouts {
47+
create = "20m" # Extending provisioning time to 20 minutes
48+
}
49+
}
50+
51+
##############################################################################
52+
# Secret Group
53+
##############################################################################
54+
55+
module "secrets_manager_group" {
56+
source = "terraform-ibm-modules/secrets-manager-secret-group/ibm"
57+
version = "1.0.1"
58+
region = local.sm_region
59+
secrets_manager_guid = local.sm_guid
60+
secret_group_name = "${var.prefix}-group"
61+
secret_group_description = "created by secrets-manager-secret-module complete example"
62+
}
63+
64+
##############################################################################
65+
# Example working with arbitrary secret
66+
##############################################################################
67+
68+
# create arbitrary secret
69+
module "secrets_manager_arbitrary_secret" {
70+
source = "../.."
71+
region = local.sm_region
72+
secrets_manager_guid = local.sm_guid
73+
secret_group_id = module.secrets_manager_group.secret_group_id
74+
secret_name = "${var.prefix}-arbitrary-secret"
75+
secret_description = "created by secrets-manager-secret-module complete example"
76+
secret_type = "arbitrary" #checkov:skip=CKV_SECRET_6
77+
secret_payload_password = local.payload
78+
secret_labels = local.secret_labels
79+
}
80+
81+
# retrieving information about the arbitrary secret
82+
data "ibm_sm_arbitrary_secret" "arbitrary_secret" {
83+
instance_id = local.sm_guid
84+
region = local.sm_region
85+
secret_id = module.secrets_manager_arbitrary_secret.secret_id
86+
}
87+
88+
##############################################################################
89+
# Example working with username / password secret
90+
##############################################################################
91+
92+
# create username / password secret
93+
module "secrets_manager_user_pass_secret" {
94+
source = "../.."
95+
region = local.sm_region
96+
secrets_manager_guid = local.sm_guid
97+
secret_group_id = module.secrets_manager_group.secret_group_id
98+
secret_name = "${var.prefix}-user-pass-secret"
99+
secret_description = "created by secrets-manager-secret-module complete example"
100+
secret_type = "username_password" #checkov:skip=CKV_SECRET_6
101+
secret_payload_password = local.payload
102+
secret_username = "terraform-user" #checkov:skip=CKV_SECRET_6
103+
secret_labels = local.secret_labels
104+
}
105+
106+
# retrieving information about the arbitrary secret
107+
data "ibm_sm_username_password_secret" "user_pass_secret" {
108+
instance_id = local.sm_guid
109+
region = local.sm_region
110+
secret_id = module.secrets_manager_user_pass_secret.secret_id
111+
}
112+
113+
##############################################################################
114+
# Example working with username / password secret (without password rotation)
115+
##############################################################################
116+
117+
# create username / password secret
118+
module "secrets_manager_user_pass_no_rotate_secret" {
119+
source = "../.."
120+
region = local.sm_region
121+
secrets_manager_guid = local.sm_guid
122+
secret_group_id = module.secrets_manager_group.secret_group_id
123+
secret_name = "${var.prefix}-user-pass-no-rotate-secret"
124+
secret_description = "created by secrets-manager-secret-module complete example"
125+
secret_type = "username_password" #checkov:skip=CKV_SECRET_6
126+
secret_payload_password = local.payload
127+
secret_username = "terraform-user" #checkov:skip=CKV_SECRET_6
128+
secret_labels = local.secret_labels
129+
secret_user_pass_auto_rotation = false
130+
}
131+
132+
# retrieving information about the arbitrary secret
133+
data "ibm_sm_username_password_secret" "user_pass_no_rotate_secret" {
134+
instance_id = local.sm_guid
135+
region = local.sm_region
136+
secret_id = module.secrets_manager_user_pass_no_rotate_secret.secret_id
137+
}
138+
139+
##############################################################################
140+
# Example working with imported cert secret
141+
##############################################################################
142+
143+
resource "tls_private_key" "ca_key" {
144+
algorithm = "RSA"
145+
}
146+
147+
resource "tls_private_key" "key" {
148+
algorithm = "RSA"
149+
}
150+
151+
resource "tls_self_signed_cert" "ca_cert" {
152+
is_ca_certificate = true
153+
private_key_pem = tls_private_key.ca_key.private_key_pem
154+
155+
subject {
156+
common_name = "goldeneye.com"
157+
organization = "GoldenEye self signed cert"
158+
}
159+
160+
validity_period_hours = 1 * 24 * 90
161+
allowed_uses = ["key_encipherment", "digital_signature", "server_auth"]
162+
}
163+
164+
resource "tls_cert_request" "request" {
165+
private_key_pem = tls_private_key.key.private_key_pem
166+
167+
subject {
168+
common_name = "goldeneye.com"
169+
organization = "GoldenEye self signed cert"
170+
}
171+
}
172+
173+
resource "tls_locally_signed_cert" "cert" {
174+
cert_request_pem = tls_cert_request.request.cert_request_pem
175+
ca_private_key_pem = tls_private_key.ca_key.private_key_pem
176+
ca_cert_pem = tls_self_signed_cert.ca_cert.cert_pem
177+
178+
validity_period_hours = 1 * 24 * 90
179+
allowed_uses = ["key_encipherment", "digital_signature", "server_auth"]
180+
}
181+
182+
# create imported cert secret
183+
module "secret_manager_imported_cert" {
184+
source = "../.."
185+
region = local.sm_region
186+
secrets_manager_guid = local.sm_guid
187+
secret_name = "${var.prefix}-imported-cert"
188+
secret_group_id = module.secrets_manager_group.secret_group_id
189+
secret_description = "created by secrets-manager-secret-module complete example"
190+
secret_type = "imported_cert" #checkov:skip=CKV_SECRET_6
191+
imported_cert_certificate = resource.tls_locally_signed_cert.cert.cert_pem
192+
imported_cert_private_key = resource.tls_private_key.key.private_key_pem
193+
imported_cert_intermediate = resource.tls_self_signed_cert.ca_cert.cert_pem
194+
}

0 commit comments

Comments
 (0)