diff --git a/README.md b/README.md
index 8f046f71..861c390e 100644
--- a/README.md
+++ b/README.md
@@ -109,7 +109,7 @@ You need the following permissions to run this module.
| [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of a Key Management Service like Key Protect or Hyper Protect Crypto Services (HPCS) that you want to use for encryption. Only used if `kms_encryption_enabled` is set to true. | `string` | `null` | no |
| [region](#input\_region) | The region where the resource will be provisioned.Its not required if passing a value for `existing_sm_instance_crn`. | `string` | `null` | no |
| [resource\_group\_id](#input\_resource\_group\_id) | The ID of the resource group | `string` | n/a | yes |
-| [secrets](#input\_secrets) | Secret Manager secrets configurations. |
| `[]` | no |
| [secrets\_manager\_name](#input\_secrets\_manager\_name) | The name of the Secrets Manager instance to create | `string` | n/a | yes |
| [skip\_en\_iam\_authorization\_policy](#input\_skip\_en\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances (scoped to the resource group) an 'Event Source Manager' role to the given Event Notifications instance passed in the `existing_en_instance_crn` input variable. In addition, no policy is created if `enable_event_notification` is set to false. | `bool` | `false` | no |
| [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy) | Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service. | `bool` | `false` | no |
diff --git a/ibm_catalog.json b/ibm_catalog.json
index 4b89b135..19be8e47 100644
--- a/ibm_catalog.json
+++ b/ibm_catalog.json
@@ -29,6 +29,14 @@
"title": "Creates a Secrets Manager instance.",
"description": "Creates an IBM Secrets Manager instance."
},
+ {
+ "title": "Create secret groups.",
+ "description": "Optionally create secret groups inside your IBM Secrets Manager instance."
+ },
+ {
+ "title": "Create access groups for your secret groups.",
+ "description": "Optionally create access groups for the secret groups inside your IBM Secrets Manager instance."
+ },
{
"title": "Optionally configure an IBM Secrets Manager IAM credentials engine to an IBM Secrets Manager instance.",
"description": "Optionally configure an IBM Secrets Manager IAM credentials engine to an IBM Secrets Manager instance."
@@ -134,12 +142,12 @@
"key": "existing_resource_group_name",
"required": true,
"custom_config": {
- "type": "resource_group",
- "grouping": "deployment",
- "original_grouping": "deployment",
- "config_constraints": {
- "identifier": "rg_name"
- }
+ "type": "resource_group",
+ "grouping": "deployment",
+ "original_grouping": "deployment",
+ "config_constraints": {
+ "identifier": "rg_name"
+ }
}
},
{
@@ -169,7 +177,7 @@
"config_constraints": {
"type": "string"
}
- }
+ }
},
{
"key": "service_plan",
@@ -252,6 +260,9 @@
},
{
"key": "secrets_manager_cbr_rules"
+ },
+ {
+ "key": "secret_groups"
}
],
"architecture": {
@@ -401,7 +412,7 @@
"config_constraints": {
"type": "string"
}
- }
+ }
},
{
"key": "service_plan",
@@ -423,12 +434,12 @@
"key": "existing_resource_group_name",
"required": true,
"custom_config": {
- "type": "resource_group",
- "grouping": "deployment",
- "original_grouping": "deployment",
- "config_constraints": {
- "identifier": "rg_name"
- }
+ "type": "resource_group",
+ "grouping": "deployment",
+ "original_grouping": "deployment",
+ "config_constraints": {
+ "identifier": "rg_name"
+ }
}
},
{
@@ -463,6 +474,9 @@
},
{
"key": "secrets_manager_cbr_rules"
+ },
+ {
+ "key": "secret_groups"
}
],
"architecture": {
diff --git a/modules/secrets/README.md b/modules/secrets/README.md
index fc8132b1..411eef03 100644
--- a/modules/secrets/README.md
+++ b/modules/secrets/README.md
@@ -50,7 +50,7 @@ module "secrets_manager" {
| Name | Source | Version |
|------|--------|---------|
-| [secret\_groups](#module\_secret\_groups) | terraform-ibm-modules/secrets-manager-secret-group/ibm | 1.2.3 |
+| [secret\_groups](#module\_secret\_groups) | terraform-ibm-modules/secrets-manager-secret-group/ibm | 1.3.2 |
| [secrets](#module\_secrets) | terraform-ibm-modules/secrets-manager-secret/ibm | 1.7.0 |
### Resources
@@ -66,7 +66,7 @@ module "secrets_manager" {
| [endpoint\_type](#input\_endpoint\_type) | The service endpoint type to communicate with the provided secrets manager instance. Possible values are `public` or `private` | `string` | `"public"` | no |
| [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | Instance ID of Secrets Manager instance in which the Secret will be added. | `string` | n/a | yes |
| [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Region which the Secret Manager is deployed. | `string` | n/a | yes |
-| [secrets](#input\_secrets) | Secret Manager secrets configurations. |
[ { "access_group_name": "general-secrets-group-access-group", "access_group_roles": [ "SecretsReader" ], "create_access_group": true, "secret_group_description": "A general purpose secrets group with an associated access group which has a secrets reader role", "secret_group_name": "General" } ]
| no |
| [secrets\_manager\_cbr\_rules](#input\_secrets\_manager\_cbr\_rules) | (Optional, list) List of CBR rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/solutions/fully-configurable/DA-cbr_rules.md) |
| `[]` | no |
| [secrets\_manager\_endpoint\_type](#input\_secrets\_manager\_endpoint\_type) | The type of endpoint (public or private) to connect to the Secrets Manager API. The Terraform provider uses this endpoint type to interact with the Secrets Manager API and configure Event Notifications. | `string` | `"private"` | no |
| [secrets\_manager\_instance\_name](#input\_secrets\_manager\_instance\_name) | The name to give the Secrets Manager instance provisioned by this solution. If a prefix input variable is specified, it is added to the value in the `-value` format. Applies only if `existing_secrets_manager_crn` is not provided. | `string` | `"secrets-manager"` | no |
diff --git a/solutions/fully-configurable/main.tf b/solutions/fully-configurable/main.tf
index 94b74d59..d2d26a88 100644
--- a/solutions/fully-configurable/main.tf
+++ b/solutions/fully-configurable/main.tf
@@ -187,6 +187,7 @@ module "secrets_manager" {
cbr_rules = var.secrets_manager_cbr_rules
endpoint_type = var.secrets_manager_endpoint_type
allowed_network = var.allowed_network
+ secrets = var.secret_groups
}
data "ibm_resource_instance" "existing_sm" {
diff --git a/solutions/fully-configurable/provisioning_secrets_groups.md b/solutions/fully-configurable/provisioning_secrets_groups.md
new file mode 100644
index 00000000..0a5a33f6
--- /dev/null
+++ b/solutions/fully-configurable/provisioning_secrets_groups.md
@@ -0,0 +1,33 @@
+# Provisioning Secrets Groups
+
+Secrets groups and access groups associated to them can be provisioned using the `secret_groups` variable.
+
+An example value:
+```
+[
+ {
+ secret_group_name = "Example Secret Group"
+ secret_group_description = "an example secret group"
+ create_access_group = true
+ access_group_name = "example-secret-group-access-group"
+ access_group_roles = ["SecretsReader"]
+ access_group_tags = []
+ },
+ {
+ secret_group_name = "Existing Secret Group"
+ secret_group_description = "an existing secret group"
+ existing_secret_group = true
+ }
+]
+```
+
+It is a list of objects, so you can specify as many secrets groups as you wish. If you do not want to create any secret groups, pass a value of `[]`.
+
+## Options:
+
+- `secret_group_name` (required) - the name of secrets group
+- `secret_group_description` (optional, default = `null`) - the description of secrets group
+- `create_access_group` (optional, default = `false`) - Whether to create an access group associated to this secrets group
+- `access_group_name` (optional, default = `null`) - Name of the access group to create. If you are creating an access group and a name is not passed, the name will become `-access-group`
+- `access_group_roles` (optional, default = `null`) - The list of roles to give to the created access group. If `create_access_group` is true, there must be a value here. Valid values: ["Reader", "Writer", "Manager", "SecretsReader", "Viewer", "Operator", "Editor", "Administrator", "Service Configuration Reader", "Key Manager"]
+- `access_group_tags` (optional, default = `[]`) - Tags that should be applied to the access group.
diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf
index 55df6bb1..d2469259 100644
--- a/solutions/fully-configurable/variables.tf
+++ b/solutions/fully-configurable/variables.tf
@@ -105,6 +105,43 @@ variable "allowed_network" {
}
}
+variable "secret_groups" {
+ type = list(object({
+ secret_group_name = string
+ secret_group_description = optional(string)
+ create_access_group = optional(bool, true)
+ access_group_name = optional(string)
+ access_group_roles = optional(list(string), ["SecretsReader"])
+ access_group_tags = optional(list(string))
+ }))
+ description = "Secret Manager secret group and access group configurations. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md)."
+ nullable = false
+ default = [
+ {
+ secret_group_name = "General"
+ secret_group_description = "A general purpose secrets group with an associated access group which has a secrets reader role"
+ create_access_group = true
+ access_group_name = "general-secrets-group-access-group"
+ access_group_roles = ["SecretsReader"]
+ }
+ ]
+ validation {
+ error_message = "The name of the secret group cannot be null or empty string."
+ condition = length([
+ for group in var.secret_groups :
+ true if(group.secret_group_name == "" || group.secret_group_name == null)
+ ]) == 0
+ }
+ validation {
+ error_message = "When creating an access group, a list of roles must be specified."
+ condition = length([
+ for group in var.secret_groups :
+ true if(group.create_access_group && group.access_group_roles == null)
+ ]) == 0
+ }
+}
+
+
########################################################################################################################
# Key Protect
########################################################################################################################
diff --git a/solutions/security-enforced/README.md b/solutions/security-enforced/README.md
index 0932c4e6..2d14eca7 100644
--- a/solutions/security-enforced/README.md
+++ b/solutions/security-enforced/README.md
@@ -42,6 +42,7 @@ No resources.
| [kms\_key\_ring\_name](#input\_kms\_key\_ring\_name) | The name for the new key ring to store the key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `-value` format. . | `string` | `"secrets-manager-key-ring"` | no |
| [prefix](#input\_prefix) | The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes |
| [region](#input\_region) | The region to provision resources to. | `string` | `"us-south"` | no |
+| [secret\_groups](#input\_secret\_groups) | Secret Manager secret group and access group configurations. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md). |
[ { "access_group_name": "general-secrets-group-access-group", "access_group_roles": [ "SecretsReader" ], "create_access_group": true, "secret_group_description": "A general purpose secrets group with an associated access group which has a secrets reader role", "secret_group_name": "General" } ]
| no |
| [secrets\_manager\_cbr\_rules](#input\_secrets\_manager\_cbr\_rules) | (Optional, list) List of CBR rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/solutions/fully-configurable/DA-cbr_rules.md) |