Skip to content

Commit 2903767

Browse files
rajatagarwal-ibmrajatagarwal-ibm
authored
feat: removed invalid addon config from security-enforced variation + general DA cleanup (#350)
1 parent fe0a498 commit 2903767

File tree

9 files changed

+146
-373
lines changed

9 files changed

+146
-373
lines changed

‎ibm_catalog.json‎

Lines changed: 100 additions & 243 deletions
Large diffs are not rendered by default.

‎reference-architecture/secrets_manager.svg‎

Lines changed: 2 additions & 2 deletions
Loading

‎solutions/fully-configurable/DA-cbr_rules.md‎

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -33,24 +33,22 @@ The `secrets_manager_cbr_rules` input variable allows you to provide a rule for
3333

3434
### Example Rule For Context-Based Restrictions Configuration
3535

36+
The following example defines a **Context-Based Restrictions (CBR) rule** that restricts access to a **Secrets Manager instance** in a specific **IBM Cloud account**, based on contextual attributes like network zone and endpoint type.
37+
3638
```hcl
3739
[
3840
{
3941
description = "Secrets Manager can be accessed from xyz"
40-
account_id = "defc0df06b644a9cabc6e44f55b3880s."
42+
account_id = "<REPLACE ME>"
4143
rule_contexts= [{
42-
attributes = [
43-
{
44-
"name" : "endpointType",
45-
"value" : "private"
46-
},
47-
{
48-
name = "networkZoneId"
49-
value = "93a51a1debe2674193217209601dde6f" # pragma: allowlist secret
50-
}
51-
]
52-
}
53-
]
44+
attributes = [{
45+
name : "endpointType",
46+
value : "private"
47+
},{
48+
name = "networkZoneId"
49+
value = "<REPLACE ME>" # pragma: allowlist secret
50+
}]
51+
}]
5452
enforcement_mode = "enabled"
5553
operations = [{
5654
api_types = [{

‎solutions/fully-configurable/README.md‎

Lines changed: 2 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,3 @@
1-
# Secrets Manager fully-configurable solution
1+
# Cloud automation for Secrets Manager (Fully configurable)
22

3-
This solution supports the following:
4-
- Taking in an existing resource group.
5-
- Provisioning and configuring of a Secrets Manager instance.
6-
- Provisioning secrets groups inside a new or pre-existing Secrets Manager instance.
7-
- Provisioning access groups to the secrets groups of the Secrets Manager instance.
8-
- Configuring KMS encryption using a newly created key, or passing an existing key.
9-
10-
![secret-manager-deployable-architecture](../../reference-architecture/secrets_manager.svg)
11-
12-
**NB:** This solution is not intended to be called by one or more other modules since it contains a provider configurations, meaning it is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers)
13-
14-
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
15-
### Requirements
16-
17-
| Name | Version |
18-
|------|---------|
19-
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
20-
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.79.1 |
21-
| <a name="requirement_time"></a> [time](#requirement\_time) | 0.13.1 |
22-
23-
### Modules
24-
25-
| Name | Source | Version |
26-
|------|--------|---------|
27-
| <a name="module_kms"></a> [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 5.1.7 |
28-
| <a name="module_kms_instance_crn_parser"></a> [kms\_instance\_crn\_parser](#module\_kms\_instance\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
29-
| <a name="module_kms_key_crn_parser"></a> [kms\_key\_crn\_parser](#module\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
30-
| <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.2.0 |
31-
| <a name="module_secrets_manager"></a> [secrets\_manager](#module\_secrets\_manager) | ../.. | n/a |
32-
33-
### Resources
34-
35-
| Name | Type |
36-
|------|------|
37-
| [ibm_en_subscription_email.email_subscription](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/en_subscription_email) | resource |
38-
| [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/en_topic) | resource |
39-
| [ibm_iam_authorization_policy.kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/iam_authorization_policy) | resource |
40-
| [ibm_iam_authorization_policy.secrets_manager_hpcs_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/iam_authorization_policy) | resource |
41-
| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource |
42-
| [time_sleep.wait_for_secrets_manager](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource |
43-
| [time_sleep.wait_for_sm_hpcs_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource |
44-
| [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/data-sources/en_destinations) | data source |
45-
| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/data-sources/iam_account_settings) | data source |
46-
| [ibm_resource_instance.existing_sm](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/data-sources/resource_instance) | data source |
47-
48-
### Inputs
49-
50-
| Name | Description | Type | Default | Required |
51-
|------|-------------|------|---------|:--------:|
52-
| <a name="input_allowed_network"></a> [allowed\_network](#input\_allowed\_network) | The types of service endpoints to set on the Secrets Manager instance. Possible values are `private-only` or `public-and-private`. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-endpoints#service-endpoints). | `string` | `"private-only"` | no |
53-
| <a name="input_event_notifications_email_list"></a> [event\_notifications\_email\_list](#input\_event\_notifications\_email\_list) | The list of email address to target out when Secrets Manager triggers an event | `list(string)` | `[]` | no |
54-
| <a name="input_event_notifications_from_email"></a> [event\_notifications\_from\_email](#input\_event\_notifications\_from\_email) | The email address used to send any Secrets Manager event coming via Event Notifications | `string` | `"[email protected]"` | no |
55-
| <a name="input_event_notifications_reply_to_email"></a> [event\_notifications\_reply\_to\_email](#input\_event\_notifications\_reply\_to\_email) | The email address specified in the 'reply\_to' section for any Secret Manager event coming via Event Notifications | `string` | `"[email protected]"` | no |
56-
| <a name="input_existing_event_notifications_instance_crn"></a> [existing\_event\_notifications\_instance\_crn](#input\_existing\_event\_notifications\_instance\_crn) | The CRN of the Event Notifications service used to enable lifecycle notifications for your Secrets Manager instance. | `string` | `null` | no |
57-
| <a name="input_existing_kms_instance_crn"></a> [existing\_kms\_instance\_crn](#input\_existing\_kms\_instance\_crn) | The CRN of the KMS instance (Hyper Protect Crypto Services or Key Protect). Required only if `existing_secrets_manager_crn` or `existing_secrets_manager_kms_key_crn` is not specified. If the KMS instance is in different account you must also provide a value for `ibmcloud_kms_api_key`. | `string` | `null` | no |
58-
| <a name="input_existing_resource_group_name"></a> [existing\_resource\_group\_name](#input\_existing\_resource\_group\_name) | The name of an existing resource group to provision resource in. | `string` | `"Default"` | no |
59-
| <a name="input_existing_secrets_manager_crn"></a> [existing\_secrets\_manager\_crn](#input\_existing\_secrets\_manager\_crn) | The CRN of an existing Secrets Manager instance. If not supplied, a new instance is created. | `string` | `null` | no |
60-
| <a name="input_existing_secrets_manager_kms_key_crn"></a> [existing\_secrets\_manager\_kms\_key\_crn](#input\_existing\_secrets\_manager\_kms\_key\_crn) | The CRN of a Key Protect or Hyper Protect Crypto Services key to use for Secrets Manager. If not specified, a key ring and key are created. | `string` | `null` | no |
61-
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key used to provision resources. | `string` | n/a | yes |
62-
| <a name="input_ibmcloud_kms_api_key"></a> [ibmcloud\_kms\_api\_key](#input\_ibmcloud\_kms\_api\_key) | The IBM Cloud API key that can create a root key and key ring in the key management service (KMS) instance. If not specified, the 'ibmcloud\_api\_key' variable is used. Specify this key if the instance in `existing_kms_instance_crn` is in an account that's different from the Secrets Manager instance. Leave this input empty if the same account owns both instances. | `string` | `null` | no |
63-
| <a name="input_kms_encryption_enabled"></a> [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set to true to enable Secrets Manager Secrets Encryption using customer managed keys. When set to true, a value must be passed for either `existing_kms_instance_crn` or `existing_secrets_manager_kms_key_crn`. Cannot be set to true if passing a value for `existing_secrets_manager_crn`. | `bool` | `false` | no |
64-
| <a name="input_kms_endpoint_type"></a> [kms\_endpoint\_type](#input\_kms\_endpoint\_type) | The endpoint for communicating with the Key Protect or Hyper Protect Crypto Services instance. Possible values: `public`, `private`. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. | `string` | `"private"` | no |
65-
| <a name="input_kms_key_name"></a> [kms\_key\_name](#input\_kms\_key\_name) | The name for the new root key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `<prefix>-value` format. | `string` | `"secrets-manager-key"` | no |
66-
| <a name="input_kms_key_ring_name"></a> [kms\_key\_ring\_name](#input\_kms\_key\_ring\_name) | The name for the new key ring to store the key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `<prefix>-value` format. . | `string` | `"secrets-manager-key-ring"` | no |
67-
| <a name="input_prefix"></a> [prefix](#input\_prefix) | The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes |
68-
| <a name="input_provider_visibility"></a> [provider\_visibility](#input\_provider\_visibility) | Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints). | `string` | `"private"` | no |
69-
| <a name="input_region"></a> [region](#input\_region) | The region to provision resources to. | `string` | `"us-south"` | no |
70-
| <a name="input_secret_groups"></a> [secret\_groups](#input\_secret\_groups) | Secret Manager secret group and access group configurations. If a prefix input variable is specified, it is added to the `access_group_name` value in the `<prefix>-value` format. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md). | <pre>list(object({<br/> secret_group_name = string<br/> secret_group_description = optional(string)<br/> create_access_group = optional(bool, true)<br/> access_group_name = optional(string)<br/> access_group_roles = optional(list(string), ["SecretsReader"])<br/> access_group_tags = optional(list(string))<br/> }))</pre> | <pre>[<br/> {<br/> "access_group_name": "general-secrets-group-access-group",<br/> "access_group_roles": [<br/> "SecretsReader"<br/> ],<br/> "create_access_group": true,<br/> "secret_group_description": "A general purpose secrets group with an associated access group which has a secrets reader role",<br/> "secret_group_name": "General"<br/> }<br/>]</pre> | no |
71-
| <a name="input_secrets_manager_cbr_rules"></a> [secrets\_manager\_cbr\_rules](#input\_secrets\_manager\_cbr\_rules) | (Optional, list) List of CBR rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/solutions/fully-configurable/DA-cbr_rules.md) | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
72-
| <a name="input_secrets_manager_endpoint_type"></a> [secrets\_manager\_endpoint\_type](#input\_secrets\_manager\_endpoint\_type) | The type of endpoint (public or private) to connect to the Secrets Manager API. The Terraform provider uses this endpoint type to interact with the Secrets Manager API and configure Event Notifications. | `string` | `"private"` | no |
73-
| <a name="input_secrets_manager_instance_name"></a> [secrets\_manager\_instance\_name](#input\_secrets\_manager\_instance\_name) | The name to give the Secrets Manager instance provisioned by this solution. If a prefix input variable is specified, it is added to the value in the `<prefix>-value` format. Applies only if `existing_secrets_manager_crn` is not provided. | `string` | `"secrets-manager"` | no |
74-
| <a name="input_secrets_manager_resource_tags"></a> [secrets\_manager\_resource\_tags](#input\_secrets\_manager\_resource\_tags) | The list of resource tags you want to associate with your Secrets Manager instance. Applies only if `existing_secrets_manager_crn` is not provided. | `list(any)` | `[]` | no |
75-
| <a name="input_service_plan"></a> [service\_plan](#input\_service\_plan) | The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard). | `string` | n/a | yes |
76-
| <a name="input_skip_secrets_manager_event_notifications_iam_auth_policy"></a> [skip\_secrets\_manager\_event\_notifications\_iam\_auth\_policy](#input\_skip\_secrets\_manager\_event\_notifications\_iam\_auth\_policy) | If set to true, this skips the creation of a service to service authorization from Secrets Manager to Event Notifications. If false, the service to service authorization is created. | `bool` | `false` | no |
77-
| <a name="input_skip_secrets_manager_iam_auth_policy"></a> [skip\_secrets\_manager\_iam\_auth\_policy](#input\_skip\_secrets\_manager\_iam\_auth\_policy) | Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine (if you are using an existing Secrets Manager isntance, attempting to re-create can cause conflicts if the policies already exist). If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service. | `bool` | `false` | no |
78-
| <a name="input_skip_secrets_manager_kms_iam_auth_policy"></a> [skip\_secrets\_manager\_kms\_iam\_auth\_policy](#input\_skip\_secrets\_manager\_kms\_iam\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no |
79-
80-
### Outputs
81-
82-
| Name | Description |
83-
|------|-------------|
84-
| <a name="output_resource_group_id"></a> [resource\_group\_id](#output\_resource\_group\_id) | Resource group ID |
85-
| <a name="output_resource_group_name"></a> [resource\_group\_name](#output\_resource\_group\_name) | Resource group name |
86-
| <a name="output_secrets_manager_crn"></a> [secrets\_manager\_crn](#output\_secrets\_manager\_crn) | CRN of the Secrets Manager instance |
87-
| <a name="output_secrets_manager_guid"></a> [secrets\_manager\_guid](#output\_secrets\_manager\_guid) | GUID of Secrets Manager instance |
88-
| <a name="output_secrets_manager_id"></a> [secrets\_manager\_id](#output\_secrets\_manager\_id) | ID of Secrets Manager instance. |
89-
| <a name="output_secrets_manager_name"></a> [secrets\_manager\_name](#output\_secrets\_manager\_name) | Name of the Secrets Manager instance |
90-
| <a name="output_secrets_manager_region"></a> [secrets\_manager\_region](#output\_secrets\_manager\_region) | Region of the Secrets Manager instance |
91-
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
3+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).

‎solutions/fully-configurable/provider.tf‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,13 @@
11
provider "ibm" {
2-
ibmcloud_api_key = var.ibmcloud_api_key
3-
region = var.region
4-
visibility = var.provider_visibility
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
visibility = var.provider_visibility
5+
private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null
56
}
67
provider "ibm" {
7-
alias = "kms"
8-
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
9-
region = local.kms_region
10-
visibility = var.provider_visibility
8+
alias = "kms"
9+
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
10+
region = local.kms_region
11+
visibility = var.provider_visibility
12+
private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null
1113
}

‎solutions/fully-configurable/variables.tf‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -28,22 +28,24 @@ variable "existing_resource_group_name" {
2828

2929
variable "region" {
3030
type = string
31-
description = "The region to provision resources to."
31+
description = "The region to provision all resources in. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/region) about how to select different regions for different services."
3232
default = "us-south"
3333
}
3434

3535
variable "prefix" {
3636
type = string
37-
description = "The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string."
37+
description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: sm-0205. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)."
3838

3939
validation {
40-
condition = (var.prefix == null ? true :
41-
alltrue([
42-
can(regex("^[a-z]{0,1}[-a-z0-9]{0,14}[a-z0-9]{0,1}$", var.prefix)),
43-
length(regexall("^.*--.*", var.prefix)) == 0
44-
])
45-
)
46-
error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 16 or fewer characters."
40+
condition = var.prefix == null || var.prefix == "" ? true : alltrue([
41+
can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), length(regexall("--", var.prefix)) == 0
42+
])
43+
error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')."
44+
}
45+
46+
validation {
47+
condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16
48+
error_message = "Prefix must not exceed 16 characters."
4749
}
4850
}
4951

0 commit comments

Comments
 (0)