diff --git a/ibm_catalog.json b/ibm_catalog.json index 65f96b83..6194dc24 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -19,42 +19,50 @@ "terraform", "solution" ], - "short_description": "Creates and configures a Secrets Manager instance.", - "long_description": "This deployable architecture is used to provision and configure an [IBM Cloud Secrets Manager](https://www.ibm.com/products/secrets-manager) instance. This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", + "short_description": "Cloud architecture including Secrets Manager instance and optional security, logging and notification services.", + "long_description": "This deployable architecture is used to provision and configure an [IBM Cloud Secrets Manager](https://www.ibm.com/products/secrets-manager) instance. **Optionally**, supports creating and/or configuring:\n* [IBM Cloud account](https://cloud.ibm.com/docs/account?topic=account-account-getting-started): To set up IBM Cloud accounts settings.\n* [Key Protect](https://cloud.ibm.com/docs/key-protect?topic=key-protect-getting-started-tutorial): For data encryption using customer-managed keys.\n* [Cloud Logs](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-getting-started): Logging and monitoring platform logs.\n* [Cloud Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started):Measure how users and applications interact with the Secrets Manager instance.\n* [Event Notifications](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-getting-started): Send notifications of events to other users, or destinations, by using email, SMS or other supported delivery channels.\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) assets, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager/main/images/secrets_manager.svg", "provider_name": "IBM", "features": [ { - "title": "Creates a Secrets Manager instance.", + "title": "Creates a Secrets Manager instance", "description": "Get started with Secrets Manager by creating an instance. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-getting-started)." }, { - "title": "Create secret groups.", + "title": "Create secret groups", "description": "Secret groups help you to organize and manage your secrets. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-secret-groups&interface=ui)." }, { - "title": "Manage access to your secrets.", + "title": "Manage access to your secrets", "description": "Manage access for secret groups by creating access groups. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-assign-access#assign-access-secret-group-console)." }, { - "title": "Configure an IAM credentials engine.", + "title": "Configure an IAM credentials engine", "description": "An IAM credentials engine can be used to manage the lifecycle of your IBM Cloud resources through Secrets Manager. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-configure-iam-engine&interface=ui)." }, { - "title": "Sets up authorization policy.", - "description": "Sets up IBM IAM authorization policy between IBM Secrets Manager instance and IBM Key Management Service (KMS) instance. It also supports Event Notification authorization policy." + "title": "Sets up authorization policy", + "description": "Sets up IBM IAM authorization policy between IBM Secrets Manager instance and IBM Key Management Service (KMS) instance. It also supports Event Notification authorization policy. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-integrations)." }, { - "title": "Configures lifecycle notifications.", + "title": "Configures lifecycle notifications", "description": "Optionally, you can choose to configure lifecycle notifications by integrating the Event Notifications service. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-event-notifications&interface=ui)." + }, + { + "title": "Sets up logging for Secrets Manager instance", + "description": "Optionally, you can set up IBM Cloud Logs service to route, alert and visualize platform logs generated by your Secrets Manager instance. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-logging)." + }, + { + "title": "Sets up monitoring operational metrics for Secrets Manager instance", + "description": "Optionally, you can set up IBM Cloud Monitoring service to measure how users and applications interact with your Secrets Manager instance. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-operational-metrics)." } ], - "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/issues](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/issues). Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ { "label": "Fully configurable", "name": "fully-configurable", + "index": 1, "install_type": "fullstack", "working_directory": "solutions/fully-configurable", "compliance": { @@ -134,6 +142,29 @@ } ] }, + { + "key": "enable_platform_metrics", + "type": "bool", + "default_value": true, + "description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).", + "required": true, + "virtual": true + }, + { + "key": "logs_routing_tenant_regions", + "type": "list(string)", + "default_value": [], + "description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).", + "required": true, + "virtual": true, + "custom_config": { + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } + }, { "key": "existing_resource_group_name", "display_name": "resource_group", @@ -161,7 +192,8 @@ "displayname": "public-and-private", "value": "public-and-private" } - ] + ], + "hidden": true }, { "key": "secrets_manager_instance_name" @@ -255,10 +287,25 @@ "key": "skip_secrets_manager_event_notifications_iam_auth_policy" }, { - "key": "secrets_manager_cbr_rules" + "key": "secrets_manager_cbr_rules", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } }, { - "key": "secret_groups" + "key": "secret_groups", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "existing_secrets_manager_crn" @@ -271,7 +318,7 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], "service_name": "secrets-manager", - "notes": "[Optional] Required if you are creating an Secrets Manager instance. 'Manager' access required to create new secret groups." + "notes": "Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups." }, { "role_crns": [ @@ -324,41 +371,25 @@ "architecture": { "features": [ { - "title": "Creates or configures an IBM Cloud Secrets Manager instance", - "description": "Creates a Secrets Manager instance. Optionally, configures an exising Secrets Manager instance." - }, - { - "title": "Creates secret groups", - "description": "Provisioning secrets groups inside a new or pre-existing Secrets Manager instance." - }, - { - "title": "Creates key rings and keys", - "description": "Configuring KMS encryption using a newly created key, or passing an existing key." - }, - { - "title": "Creates access groups", - "description": "Provisioning access groups to the secrets groups of the Secrets Manager instance." - }, - { - "title": "Configures event notifications", - "description": "Configures lifecycle notifications for the Secrets Manager instance using the Event Notifications service." + "title": " ", + "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case." } ], "diagrams": [ { "diagram": { - "caption": "Secrets Manager", - "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager/main/reference-architecture/secrets_manager.svg", + "caption": "Secrets Manager and optional surround services.", + "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-secrets-manager/rally/reference-architecture/secrets_manager.svg", "type": "image/svg+xml" }, - "description": "This architecture supports creating and configuring a Secrets Manager instance." + "description": "This architecture supports creating and configuring a Secrets Manager instance and optional security, logging and notification services." } ] }, "dependencies": [ { "name": "deploy-arch-ibm-account-infra-base", - "description": "Cloud automation for account configuration organizes your IBM Cloud account with a ready-made set of resource groups by default. When you enable the “with account settings” option, it also applies baseline security and governance settings.", + "description": "Advanced users can leverage cloud automation for account configuration to configure IBM Cloud account with a ready-made set of resource groups by default. When you enable the \"with account settings\" option, it also applies baseline security and governance settings.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "resource-group-only", @@ -375,11 +406,6 @@ { "dependency_output": "security_resource_group_name", "version_input": "existing_resource_group_name" - }, - { - "dependency_input": "provider_visibility", - "version_input": "provider_visibility", - "reference_version": true } ], "optional": true, @@ -420,7 +446,7 @@ }, { "name": "deploy-arch-ibm-observability", - "description": "Enable to provisions and configures IBM Cloud Monitoring, Activity Tracker, and Log Analysis services for analysing events generated from the Events Notification instance.", + "description": "Enables provisioning and configuration of IBM Cloud Logs to collect, route, analyze, and visualize platform logs and events — including those generated by the Event Notifications instance — for enhanced visibility, alerting, and troubleshooting.", "flavors": [ "instances" ], @@ -436,6 +462,16 @@ "dependency_input": "region", "version_input": "region", "reference_version": true + }, + { + "dependency_input": "enable_platform_metrics", + "version_input": "enable_platform_metrics", + "reference_version": true + }, + { + "dependency_input": "logs_routing_tenant_regions", + "version_input": "logs_routing_tenant_regions", + "reference_version": true } ], "optional": true, @@ -444,7 +480,7 @@ }, { "name": "deploy-arch-ibm-event-notifications", - "description": "Enable Cloud Automation for Event Notifications to configure lifecycle notifications for your Secrets Manager instance.", + "description": "Configures lifecycle notifications for your Secrets Manager instance. Also, supports creating a topic and configuring email subscriptions.", "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", "flavors": [ "fully-configurable" @@ -477,6 +513,7 @@ { "label": "Security-enforced", "name": "security-enforced", + "index": 2, "install_type": "fullstack", "working_directory": "solutions/security-enforced", "compliance": { @@ -627,10 +664,25 @@ "key": "skip_secrets_manager_event_notifications_iam_auth_policy" }, { - "key": "secrets_manager_cbr_rules" + "key": "secrets_manager_cbr_rules", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment", + "config_constraints": { + "type": "string" + } + } }, { - "key": "secret_groups" + "key": "secret_groups", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "existing_secrets_manager_crn" @@ -643,101 +695,14 @@ "crn:v1:bluemix:public:iam::::serviceRole:Manager" ], "service_name": "secrets-manager", - "notes": "[Optional] Required if you are creating an Secrets Manager instance. 'Manager' access required to create new secret groups." - }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "event-notifications", - "notes": "[Optional] Required if you are configuring an Event Notifications Instance." - }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "sysdig-monitor", - "notes": "[Optional] Required if you are consuming the Observability deployable architecture which sets up Cloud Monitoring." - }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "logs", - "notes": "[Optional] Required if you are consuming the Observability deployable architecture which sets up Cloud Logs." - }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "hs-crypto", - "notes": "[Optional] Required if you are creating/configuring keys in an existing Hyper Protect Crypto Services (HPCS) instance for encryption." - }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::serviceRole:Manager", - "crn:v1:bluemix:public:iam::::role:Editor" - ], - "service_name": "kms", - "notes": "[Optional] Required if you are creating/configuring Key Protect instance and keys for encryption." - }, - { - "role_crns": [ - "crn:v1:bluemix:public:iam::::role:Administrator" - ], - "service_name": "iam-identity", - "notes": "[Optional] Required if Cloud automation for account configuration is enabled." + "notes": "Required for creating an Secrets Manager instance. 'Manager' access required to create new secret groups." } ], "architecture": { "features": [ { - "title": "Secrets manager instance creation", - "description": "Yes" - }, - { - "title": "Use existing secrets manager instance", - "description": "Yes" - }, - { - "title": "New resource group creation", - "description": "No" - }, - { - "title": "Use existing resource group", - "description": "Yes" - }, - { - "title": "Enforced private-only endpoint communication", - "description": "Yes" - }, - { - "title": "Enforced KMS encryption", - "description": "Yes" - }, - { - "title": "KMS instance creation", - "description": "No" - }, - { - "title": "KMS key ring and key creation", - "description": "Yes" - }, - { - "title": "Use existing KMS key", - "description": "Yes" - }, - { - "title": "IAM s2s auth policies creation", - "description": "Yes" - }, - { - "title": "Event Notifications integration", - "description": "Yes" + "title": " ", + "description": "Configured to use IBM secure by default standards that can't be changed." } ], "diagrams": [ @@ -751,114 +716,6 @@ } ] }, - "dependencies": [ - { - "name": "deploy-arch-ibm-account-infra-base", - "description": "Cloud automation for account configuration organizes your IBM Cloud account with a ready-made set of resource groups by default. When you enable the “with account settings” option, it also applies baseline security and governance settings.", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "flavors": [ - "resource-group-only", - "resource-groups-with-account-settings" - ], - "default_flavor": "resource-group-only", - "id": "63641cec-6093-4b4f-b7b0-98d2f4185cd6-global", - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_output": "security_resource_group_name", - "version_input": "existing_resource_group_name" - } - ], - "optional": true, - "on_by_default": false, - "version": "v3.0.7" - }, - { - "name": "deploy-arch-ibm-kms", - "id": "2cad4789-fa90-4886-9c9e-857081c273ee-global", - "description": "Enable Cloud automation for Key Protect to use your own managed encryption keys. If disabled, IBM Cloud's default service-managed encryption is used.", - "flavors": [ - "fully-configurable" - ], - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "input_mapping": [ - { - "dependency_output": "kms_instance_crn", - "version_input": "existing_kms_instance_crn" - }, - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - } - ], - "optional": true, - "on_by_default": true, - "version": "v5.1.4" - }, - { - "name": "deploy-arch-ibm-observability", - "description": "Enable to provisions and configures IBM Cloud Monitoring, Activity Tracker, and Log Analysis services for analysing events generated from the Events Notification instance.", - "flavors": [ - "instances" - ], - "id": "a3137d28-79e0-479d-8a24-758ebd5a0eab-global", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "input_mapping": [ - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - } - ], - "optional": true, - "on_by_default": true, - "version": "v3.0.3" - }, - { - "name": "deploy-arch-ibm-event-notifications", - "description": "Enable Cloud Automation for Event Notifications to configure lifecycle notifications for your Secrets Manager instance.", - "catalog_id": "7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3", - "flavors": [ - "fully-configurable" - ], - "id": "c7ac3ee6-4f48-4236-b974-b0cd8c624a46-global", - "input_mapping": [ - { - "dependency_output": "crn", - "version_input": "existing_event_notifications_instance_crn" - }, - { - "dependency_input": "prefix", - "version_input": "prefix", - "reference_version": true - }, - { - "dependency_input": "region", - "version_input": "region", - "reference_version": true - } - ], - "optional": true, - "on_by_default": true, - "version": "v2.3.7" - } - ], - "dependency_version_2": true, "terraform_version": "1.10.5" } ] diff --git a/reference-architecture/secrets_manager.svg b/reference-architecture/secrets_manager.svg index 14b9d2a2..7b81fcc9 100644 --- a/reference-architecture/secrets_manager.svg +++ b/reference-architecture/secrets_manager.svg @@ -1,4 +1,4 @@ - + -
IBM Cloud
IBM Cloud
Region
Region
Existing Resource Group
Existing Resource Group
Secrets Manager
Secrets Manager
s2s IAM auth
s2s IAM auth
Existing KMS
Existing KMS
Key Ring
Key Ring
Root  Key
Existing Event Notifications
Identity & Access
Management
Identity & Access...
user
Access Groups
Access Groups
Secret Groups
Secret Groups
Text is not SVG - cannot display
\ No newline at end of file +
Secret Groups
Secret Groups
IAM Engine
IAM Engine
[Optional] Event Notifications
[Optional] Event Notific...
Event Notifications Topic
IBM Cloud
IBM Cloud
Region
Region
Existing Resource Group
Existing Resource Group
Secrets Manager
Secrets Manager
[Optional] Key Management Services
[Optional] Key Managemen...
Key Ring
Key Ring
Root  Key
Identity & Access
Management
Identity & Access...
Access Groups
Access Groups
Cloud logs
Observability
Observabil...
[Optional]
[Option...
Cloud Monitoring
S2S auth policy
S2S auth policy
Text is not SVG - cannot display
\ No newline at end of file diff --git a/solutions/fully-configurable/DA-cbr_rules.md b/solutions/fully-configurable/DA-cbr_rules.md index 4ff1ac22..5152862f 100644 --- a/solutions/fully-configurable/DA-cbr_rules.md +++ b/solutions/fully-configurable/DA-cbr_rules.md @@ -33,24 +33,22 @@ The `secrets_manager_cbr_rules` input variable allows you to provide a rule for ### Example Rule For Context-Based Restrictions Configuration +The following example defines a **Context-Based Restrictions (CBR) rule** that restricts access to a **Secrets Manager instance** in a specific **IBM Cloud account**, based on contextual attributes like network zone and endpoint type. + ```hcl [ { description = "Secrets Manager can be accessed from xyz" - account_id = "defc0df06b644a9cabc6e44f55b3880s." + account_id = "" rule_contexts= [{ - attributes = [ - { - "name" : "endpointType", - "value" : "private" - }, - { - name = "networkZoneId" - value = "93a51a1debe2674193217209601dde6f" # pragma: allowlist secret - } - ] - } - ] + attributes = [{ + name : "endpointType", + value : "private" + },{ + name = "networkZoneId" + value = "" # pragma: allowlist secret + }] + }] enforcement_mode = "enabled" operations = [{ api_types = [{ diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index 75ea6b9e..3d0853ca 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -1,91 +1,3 @@ -# Secrets Manager fully-configurable solution +# Cloud automation for Secrets Manager (Fully configurable) -This solution supports the following: -- Taking in an existing resource group. -- Provisioning and configuring of a Secrets Manager instance. -- Provisioning secrets groups inside a new or pre-existing Secrets Manager instance. -- Provisioning access groups to the secrets groups of the Secrets Manager instance. -- Configuring KMS encryption using a newly created key, or passing an existing key. - -![secret-manager-deployable-architecture](../../reference-architecture/secrets_manager.svg) - -**NB:** This solution is not intended to be called by one or more other modules since it contains a provider configurations, meaning it is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers) - - -### Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.9.0 | -| [ibm](#requirement\_ibm) | 1.79.1 | -| [time](#requirement\_time) | 0.13.1 | - -### Modules - -| Name | Source | Version | -|------|--------|---------| -| [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 5.1.7 | -| [kms\_instance\_crn\_parser](#module\_kms\_instance\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 | -| [kms\_key\_crn\_parser](#module\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 | -| [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.2.0 | -| [secrets\_manager](#module\_secrets\_manager) | ../.. | n/a | - -### Resources - -| Name | Type | -|------|------| -| [ibm_en_subscription_email.email_subscription](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/en_subscription_email) | resource | -| [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/en_topic) | resource | -| [ibm_iam_authorization_policy.kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/iam_authorization_policy) | resource | -| [ibm_iam_authorization_policy.secrets_manager_hpcs_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/resources/iam_authorization_policy) | resource | -| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource | -| [time_sleep.wait_for_secrets_manager](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource | -| [time_sleep.wait_for_sm_hpcs_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource | -| [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/data-sources/en_destinations) | data source | -| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/data-sources/iam_account_settings) | data source | -| [ibm_resource_instance.existing_sm](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.1/docs/data-sources/resource_instance) | data source | - -### Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [allowed\_network](#input\_allowed\_network) | The types of service endpoints to set on the Secrets Manager instance. Possible values are `private-only` or `public-and-private`. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-endpoints#service-endpoints). | `string` | `"private-only"` | no | -| [event\_notifications\_email\_list](#input\_event\_notifications\_email\_list) | The list of email address to target out when Secrets Manager triggers an event | `list(string)` | `[]` | no | -| [event\_notifications\_from\_email](#input\_event\_notifications\_from\_email) | The email address used to send any Secrets Manager event coming via Event Notifications | `string` | `"compliancealert@ibm.com"` | no | -| [event\_notifications\_reply\_to\_email](#input\_event\_notifications\_reply\_to\_email) | The email address specified in the 'reply\_to' section for any Secret Manager event coming via Event Notifications | `string` | `"no-reply@ibm.com"` | no | -| [existing\_event\_notifications\_instance\_crn](#input\_existing\_event\_notifications\_instance\_crn) | The CRN of the Event Notifications service used to enable lifecycle notifications for your Secrets Manager instance. | `string` | `null` | no | -| [existing\_kms\_instance\_crn](#input\_existing\_kms\_instance\_crn) | The CRN of the KMS instance (Hyper Protect Crypto Services or Key Protect). Required only if `existing_secrets_manager_crn` or `existing_secrets_manager_kms_key_crn` is not specified. If the KMS instance is in different account you must also provide a value for `ibmcloud_kms_api_key`. | `string` | `null` | no | -| [existing\_resource\_group\_name](#input\_existing\_resource\_group\_name) | The name of an existing resource group to provision resource in. | `string` | `"Default"` | no | -| [existing\_secrets\_manager\_crn](#input\_existing\_secrets\_manager\_crn) | The CRN of an existing Secrets Manager instance. If not supplied, a new instance is created. | `string` | `null` | no | -| [existing\_secrets\_manager\_kms\_key\_crn](#input\_existing\_secrets\_manager\_kms\_key\_crn) | The CRN of a Key Protect or Hyper Protect Crypto Services key to use for Secrets Manager. If not specified, a key ring and key are created. | `string` | `null` | no | -| [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key used to provision resources. | `string` | n/a | yes | -| [ibmcloud\_kms\_api\_key](#input\_ibmcloud\_kms\_api\_key) | The IBM Cloud API key that can create a root key and key ring in the key management service (KMS) instance. If not specified, the 'ibmcloud\_api\_key' variable is used. Specify this key if the instance in `existing_kms_instance_crn` is in an account that's different from the Secrets Manager instance. Leave this input empty if the same account owns both instances. | `string` | `null` | no | -| [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set to true to enable Secrets Manager Secrets Encryption using customer managed keys. When set to true, a value must be passed for either `existing_kms_instance_crn` or `existing_secrets_manager_kms_key_crn`. Cannot be set to true if passing a value for `existing_secrets_manager_crn`. | `bool` | `false` | no | -| [kms\_endpoint\_type](#input\_kms\_endpoint\_type) | The endpoint for communicating with the Key Protect or Hyper Protect Crypto Services instance. Possible values: `public`, `private`. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. | `string` | `"private"` | no | -| [kms\_key\_name](#input\_kms\_key\_name) | The name for the new root key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `-value` format. | `string` | `"secrets-manager-key"` | no | -| [kms\_key\_ring\_name](#input\_kms\_key\_ring\_name) | The name for the new key ring to store the key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `-value` format. . | `string` | `"secrets-manager-key-ring"` | no | -| [prefix](#input\_prefix) | The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes | -| [provider\_visibility](#input\_provider\_visibility) | Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints). | `string` | `"private"` | no | -| [region](#input\_region) | The region to provision resources to. | `string` | `"us-south"` | no | -| [secret\_groups](#input\_secret\_groups) | Secret Manager secret group and access group configurations. If a prefix input variable is specified, it is added to the `access_group_name` value in the `-value` format. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md). |
list(object({
secret_group_name = string
secret_group_description = optional(string)
create_access_group = optional(bool, true)
access_group_name = optional(string)
access_group_roles = optional(list(string), ["SecretsReader"])
access_group_tags = optional(list(string))
}))
|
[
{
"access_group_name": "general-secrets-group-access-group",
"access_group_roles": [
"SecretsReader"
],
"create_access_group": true,
"secret_group_description": "A general purpose secrets group with an associated access group which has a secrets reader role",
"secret_group_name": "General"
}
]
| no | -| [secrets\_manager\_cbr\_rules](#input\_secrets\_manager\_cbr\_rules) | (Optional, list) List of CBR rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/solutions/fully-configurable/DA-cbr_rules.md) |
list(object({
description = string
account_id = string
rule_contexts = list(object({
attributes = optional(list(object({
name = string
value = string
}))) }))
enforcement_mode = string
operations = optional(list(object({
api_types = list(object({
api_type_id = string
}))
})))
}))
| `[]` | no | -| [secrets\_manager\_endpoint\_type](#input\_secrets\_manager\_endpoint\_type) | The type of endpoint (public or private) to connect to the Secrets Manager API. The Terraform provider uses this endpoint type to interact with the Secrets Manager API and configure Event Notifications. | `string` | `"private"` | no | -| [secrets\_manager\_instance\_name](#input\_secrets\_manager\_instance\_name) | The name to give the Secrets Manager instance provisioned by this solution. If a prefix input variable is specified, it is added to the value in the `-value` format. Applies only if `existing_secrets_manager_crn` is not provided. | `string` | `"secrets-manager"` | no | -| [secrets\_manager\_resource\_tags](#input\_secrets\_manager\_resource\_tags) | The list of resource tags you want to associate with your Secrets Manager instance. Applies only if `existing_secrets_manager_crn` is not provided. | `list(any)` | `[]` | no | -| [service\_plan](#input\_service\_plan) | The pricing plan to use when provisioning a Secrets Manager instance. Possible values: `standard`, `trial`. You can create only one Trial instance of Secrets Manager per account. Before you can create a new Trial instance, you must delete the existing Trial instance and its reclamation. [Learn more](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-create-instance&interface=ui#upgrade-instance-standard). | `string` | n/a | yes | -| [skip\_secrets\_manager\_event\_notifications\_iam\_auth\_policy](#input\_skip\_secrets\_manager\_event\_notifications\_iam\_auth\_policy) | If set to true, this skips the creation of a service to service authorization from Secrets Manager to Event Notifications. If false, the service to service authorization is created. | `bool` | `false` | no | -| [skip\_secrets\_manager\_iam\_auth\_policy](#input\_skip\_secrets\_manager\_iam\_auth\_policy) | Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine (if you are using an existing Secrets Manager isntance, attempting to re-create can cause conflicts if the policies already exist). If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service. | `bool` | `false` | no | -| [skip\_secrets\_manager\_kms\_iam\_auth\_policy](#input\_skip\_secrets\_manager\_kms\_iam\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | - -### Outputs - -| Name | Description | -|------|-------------| -| [resource\_group\_id](#output\_resource\_group\_id) | Resource group ID | -| [resource\_group\_name](#output\_resource\_group\_name) | Resource group name | -| [secrets\_manager\_crn](#output\_secrets\_manager\_crn) | CRN of the Secrets Manager instance | -| [secrets\_manager\_guid](#output\_secrets\_manager\_guid) | GUID of Secrets Manager instance | -| [secrets\_manager\_id](#output\_secrets\_manager\_id) | ID of Secrets Manager instance. | -| [secrets\_manager\_name](#output\_secrets\_manager\_name) | Name of the Secrets Manager instance | -| [secrets\_manager\_region](#output\_secrets\_manager\_region) | Region of the Secrets Manager instance | - +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/fully-configurable/provider.tf b/solutions/fully-configurable/provider.tf index 65c38f7d..46c6f484 100644 --- a/solutions/fully-configurable/provider.tf +++ b/solutions/fully-configurable/provider.tf @@ -1,11 +1,13 @@ provider "ibm" { - ibmcloud_api_key = var.ibmcloud_api_key - region = var.region - visibility = var.provider_visibility + ibmcloud_api_key = var.ibmcloud_api_key + region = var.region + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null } provider "ibm" { - alias = "kms" - ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key - region = local.kms_region - visibility = var.provider_visibility + alias = "kms" + ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key + region = local.kms_region + visibility = var.provider_visibility + private_endpoint_type = (var.provider_visibility == "private" && var.region == "ca-mon") ? "vpe" : null } diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index eeb64d7e..621f767d 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -28,22 +28,24 @@ variable "existing_resource_group_name" { variable "region" { type = string - description = "The region to provision resources to." + description = "The region to provision all resources in. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/region) about how to select different regions for different services." default = "us-south" } variable "prefix" { type = string - description = "The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: sm-0205. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { - condition = (var.prefix == null ? true : - alltrue([ - can(regex("^[a-z]{0,1}[-a-z0-9]{0,14}[a-z0-9]{0,1}$", var.prefix)), - length(regexall("^.*--.*", var.prefix)) == 0 - ]) - ) - error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 16 or fewer characters." + condition = var.prefix == null || var.prefix == "" ? true : alltrue([ + can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), length(regexall("--", var.prefix)) == 0 + ]) + error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." + } + + validation { + condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 + error_message = "Prefix must not exceed 16 characters." } } diff --git a/solutions/security-enforced/README.md b/solutions/security-enforced/README.md index a18d88d6..47a003da 100644 --- a/solutions/security-enforced/README.md +++ b/solutions/security-enforced/README.md @@ -40,7 +40,7 @@ No resources. | [ibmcloud\_kms\_api\_key](#input\_ibmcloud\_kms\_api\_key) | Leave this input empty if the same account owns both the Secrets Manager and KMS instances. Otherwise, specify an IBM Cloud API key in the account containing the key management service (KMS) instance that can create a root key and key ring. If not specified, the 'ibmcloud\_api\_key' variable is used. | `string` | `null` | no | | [kms\_key\_name](#input\_kms\_key\_name) | The name for the new root key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `-value` format. | `string` | `"secrets-manager-key"` | no | | [kms\_key\_ring\_name](#input\_kms\_key\_ring\_name) | The name for the new key ring to store the key. Applies only if `existing_secrets_manager_kms_key_crn` is not specified. If a prefix input variable is passed, it is added to the value in the `-value` format. . | `string` | `"secrets-manager-key-ring"` | no | -| [prefix](#input\_prefix) | The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes | +| [prefix](#input\_prefix) | The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: sm-0205. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md). | `string` | n/a | yes | | [region](#input\_region) | The region to provision resources to. | `string` | `"us-south"` | no | | [secret\_groups](#input\_secret\_groups) | Secret Manager secret group and access group configurations. If a prefix input variable is specified, it is added to the `access_group_name` value in the `-value` format. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/solutions/fully-configurable/provisioning_secrets_groups.md). |
list(object({
secret_group_name = string
secret_group_description = optional(string)
create_access_group = optional(bool, true)
access_group_name = optional(string)
access_group_roles = optional(list(string), ["SecretsReader"])
access_group_tags = optional(list(string))
}))
|
[
{
"access_group_name": "general-secrets-group-access-group",
"access_group_roles": [
"SecretsReader"
],
"create_access_group": true,
"secret_group_description": "A general purpose secrets group with an associated access group which has a secrets reader role",
"secret_group_name": "General"
}
]
| no | | [secrets\_manager\_cbr\_rules](#input\_secrets\_manager\_cbr\_rules) | (Optional, list) List of CBR rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/blob/main/solutions/fully-configurable/DA-cbr_rules.md) |
list(object({
description = string
account_id = string
rule_contexts = list(object({
attributes = optional(list(object({
name = string
value = string
}))) }))
enforcement_mode = string
operations = optional(list(object({
api_types = list(object({
api_type_id = string
}))
})))
}))
| `[]` | no | diff --git a/solutions/security-enforced/terraform.log b/solutions/security-enforced/terraform.log new file mode 100644 index 00000000..e69de29b diff --git a/solutions/security-enforced/variables.tf b/solutions/security-enforced/variables.tf index 9a753d9b..490f62a5 100644 --- a/solutions/security-enforced/variables.tf +++ b/solutions/security-enforced/variables.tf @@ -23,16 +23,18 @@ variable "region" { variable "prefix" { type = string - description = "The prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: sm-0205. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)." validation { - condition = (var.prefix == null ? true : - alltrue([ - can(regex("^[a-z]{0,1}[-a-z0-9]{0,14}[a-z0-9]{0,1}$", var.prefix)), - length(regexall("^.*--.*", var.prefix)) == 0 - ]) - ) - error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 16 or fewer characters." + condition = var.prefix == null || var.prefix == "" ? true : alltrue([ + can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), length(regexall("--", var.prefix)) == 0 + ]) + error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." + } + + validation { + condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 + error_message = "Prefix must not exceed 16 characters." } }