Skip to content

Commit e7598e2

Browse files
authored
feat: Root module updates:<br>- existing_kms_instance_guid is no longer a supported input. The code will now parse the GUID from the KMS key CRN<br>- added new input use_same_kms_key_for_backups to give more control over KMS key usage<br>- kms_encryption_enabled has been renamed to use_ibm_owned_encryption_key<br>- fscloud submodule updates:<br>- added new inputs use_default_backup_encryption_key and use_same_kms_key_for_backups<br>DA updates<br>- Removed the input existing_backup_kms_instance_crn. If you want to use a different KMS key for backups, you can use the existing_backup_kms_key_crn input to use an existing key. The DA only supports creating an new key that will be used for both data and backups encryption.<br>- The skip_iam_authorization_policy input has been renamed to skip_es_kms_auth_policy<br> If passing a value for ibmcloud_kms_api_key, and creating a KMS auth policy, that policy will now be scoped to the exact KMS key. (#351)
1 parent 349c80e commit e7598e2

26 files changed

+1110
-65
lines changed

.catalog-onboard-pipeline.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -12,3 +12,9 @@ offerings:
1212
scc:
1313
instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
1414
region: us-south
15+
- name: enterprise
16+
mark_ready: true
17+
install_type: fullstack
18+
scc:
19+
instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
20+
region: us-south

README.md

+7-7
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,10 @@ unless real values don't help users know what to change.
3838
```hcl
3939
module "event_streams" {
4040
source = "terraform-ibm-modules/event-streams/ibm"
41-
version = "latest" # Replace "latest" with a release version to lock into a specific release
42-
resource_group = "event-streams-rg"
43-
plan = "standard"
44-
topics = [
41+
version = "X.Y.Z" # Replace "X.Y.Z" with a release version to lock into a specific release
42+
resource_group_id = "xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX" # Replace with the actual ID of resource group to use
43+
plan = "standard"
44+
topics = [
4545
{
4646
name = "topic-1"
4747
partitions = 1
@@ -63,7 +63,7 @@ module "event_streams" {
6363
}
6464
}
6565
]
66-
schema_id = [{
66+
schemas = [{
6767
schema_id = "my-es-schema_1"
6868
schema = {
6969
type = "string"
@@ -115,6 +115,7 @@ You need the following permissions to run this module.
115115
|------|--------|---------|
116116
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.29.0 |
117117
| <a name="module_es_guid_crn_parser"></a> [es\_guid\_crn\_parser](#module\_es\_guid\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
118+
| <a name="module_kms_key_crn_parser"></a> [kms\_key\_crn\_parser](#module\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
118119

119120
### Resources
120121

@@ -143,7 +144,6 @@ You need the following permissions to run this module.
143144
| <a name="input_create_timeout"></a> [create\_timeout](#input\_create\_timeout) | The timeout value for creating an Event Streams instance. Specify `3h` for an Enterprise plan instance. Add 1 h for each level of non-default throughput. Add 30 min for each level of non-default storage size. | `string` | `"3h"` | no |
144145
| <a name="input_delete_timeout"></a> [delete\_timeout](#input\_delete\_timeout) | The timeout value for deleting an Event Streams instance. | `string` | `"15m"` | no |
145146
| <a name="input_es_name"></a> [es\_name](#input\_es\_name) | The name to give the Event Streams instance created by this module. | `string` | n/a | yes |
146-
| <a name="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of the Hyper Protect Crypto Services or Key Protect instance in which the key specified in var.kms\_key\_crn is coming from. Required only if var.kms\_encryption\_enabled is set to true, var.skip\_kms\_iam\_authorization\_policy is set to false, and you pass a value for var.kms\_key\_crn. | `string` | `null` | no |
147147
| <a name="input_kms_encryption_enabled"></a> [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set this to true to control the encryption keys used to encrypt the data that you store in IBM Cloud® Databases. If set to false, the data is encrypted by using randomly generated keys. For more info on Key Protect integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect. For more info on HPCS integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs | `bool` | `false` | no |
148148
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of the key management service (Key Protect or Hyper Protect Crypto Services) to use to encrypt the payload data. [Learn more](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption) about integrating Hyper Protect Crypto Services with Event Streams. | `string` | `null` | no |
149149
| <a name="input_metrics"></a> [metrics](#input\_metrics) | Enhanced metrics to activate, as list of strings. Only allowed for enterprise plans. Allowed values: 'topic', 'partition', 'consumers'. | `list(string)` | `[]` | no |
@@ -158,7 +158,7 @@ You need the following permissions to run this module.
158158
| <a name="input_service_credential_names"></a> [service\_credential\_names](#input\_service\_credential\_names) | The mapping of names and roles for service credentials that you want to create for the Event streams. | `map(string)` | `{}` | no |
159159
| <a name="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints) | The type of service endpoints. Possible values: 'public', 'private', 'public-and-private'. | `string` | `"public"` | no |
160160
| <a name="input_skip_es_s2s_iam_authorization_policy"></a> [skip\_es\_s2s\_iam\_authorization\_policy](#input\_skip\_es\_s2s\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that will allow all Event Streams instances in the given resource group access to read from the mirror source instance. This policy is required when creating a mirroring instance, and will only be created if a value is passed in the mirroring input. | `bool` | `false` | no |
161-
| <a name="input_skip_kms_iam_authorization_policy"></a> [skip\_kms\_iam\_authorization\_policy](#input\_skip\_kms\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Event Streams database instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_guid` variable. In addition, no policy is created if var.kms\_encryption\_enabled is set to false. | `bool` | `false` | no |
161+
| <a name="input_skip_kms_iam_authorization_policy"></a> [skip\_kms\_iam\_authorization\_policy](#input\_skip\_kms\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Event Streams database instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `kms_key_crn` variable. In addition, no policy is created if var.kms\_encryption\_enabled is set to false. | `bool` | `false` | no |
162162
| <a name="input_storage_size"></a> [storage\_size](#input\_storage\_size) | Storage size of the Event Streams in GB. Applies only to Enterprise plan instances. Possible values: `2048`, `4096`, `6144`, `8192`, `10240`, `12288`. Storage capacity cannot be reduced after the instance is created. When the `throughput` input variable is set to `300`, storage size starts at 4096. When `throughput` is `450`, storage size starts starts at `6144`. | `number` | `"2048"` | no |
163163
| <a name="input_tags"></a> [tags](#input\_tags) | The list of tags associated with the Event Steams instance. | `list(string)` | `[]` | no |
164164
| <a name="input_throughput"></a> [throughput](#input\_throughput) | Throughput capacity in MB per second. Applies only to Enterprise plan instances. Possible values: `150`, `300`, `450`. | `number` | `"150"` | no |

cra-config.yaml

+6-3
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,12 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "examples/complete" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "solutions/enterprise" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
66
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3" # SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
77
CRA_ENVIRONMENT_VARIABLES:
8-
TF_VAR_existing_kms_instance_guid: "e6dce284-e80f-46e1-a3c1-830f7adff7a9"
9-
TF_VAR_kms_key_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9:key:76170fae-4e0c-48c3-8ebe-326059ebb533"
8+
TF_VAR_existing_kms_instance_crn: "crn:v1:bluemix:public:hs-crypto:us-south:a/abac0df06b644a9cabc6e44f55b3880e:e6dce284-e80f-46e1-a3c1-830f7adff7a9::"
9+
TF_VAR_resource_group_name: "test-event-s-cra"
10+
TF_VAR_provider_visibility: "public"
11+
TF_VAR_use_existing_resource_group: false
12+
TF_VAR_kms_endpoint_type: "public"

examples/fscloud/main.tf

+9-10
Original file line numberDiff line numberDiff line change
@@ -69,16 +69,15 @@ module "cbr_zone_schematics" {
6969
# #############################################################################
7070

7171
module "event_streams" {
72-
source = "../../modules/fscloud"
73-
resource_group_id = module.resource_group.resource_group_id
74-
es_name = "${var.prefix}-es-fs"
75-
kms_key_crn = var.kms_key_crn
76-
schemas = var.schemas
77-
tags = var.resource_tags
78-
topics = var.topics
79-
existing_kms_instance_guid = var.existing_kms_instance_guid
80-
metrics = ["topic", "partition", "consumers"]
81-
mirroring_topic_patterns = ["topic-1", "topic-2"]
72+
source = "../../modules/fscloud"
73+
resource_group_id = module.resource_group.resource_group_id
74+
es_name = "${var.prefix}-es-fs"
75+
kms_key_crn = var.kms_key_crn
76+
schemas = var.schemas
77+
tags = var.resource_tags
78+
topics = var.topics
79+
metrics = ["topic", "partition", "consumers"]
80+
mirroring_topic_patterns = ["topic-1", "topic-2"]
8281
mirroring = {
8382
source_crn = var.event_streams_source_crn # Required for mirroring
8483
source_alias = "source-alias" # Required for mirroring

examples/fscloud/variables.tf

-5
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,6 @@ variable "topics" {
5454
default = []
5555
}
5656

57-
variable "existing_kms_instance_guid" {
58-
description = "The GUID of the Hyper Protect Crypto service in which the key specified in var.kms_key_crn is coming from"
59-
type = string
60-
}
61-
6257
variable "kms_key_crn" {
6358
type = string
6459
description = "The root key CRN of a Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs&interface=ui for more information on integrating HPCS with Event Streams instance."

ibm_catalog.json

+231-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,25 @@
4646
"key": "ibmcloud_api_key"
4747
},
4848
{
49-
"key": "prefix"
49+
"key": "provider_visibility",
50+
"options": [
51+
{
52+
"displayname": "private",
53+
"value": "private"
54+
},
55+
{
56+
"displayname": "public",
57+
"value": "public"
58+
},
59+
{
60+
"displayname": "public-and-private",
61+
"value": "public-and-private"
62+
}
63+
]
64+
},
65+
{
66+
"key": "prefix",
67+
"required": true
5068
},
5169
{
5270
"key": "use_existing_resource_group"
@@ -128,6 +146,9 @@
128146
},
129147
{
130148
"key": "topics"
149+
},
150+
{
151+
"key": "service_credential_names"
131152
}
132153
],
133154
"iam_permissions": [
@@ -167,6 +188,215 @@
167188
}
168189
]
169190
}
191+
},
192+
{
193+
"label": "enterprise",
194+
"name": "enterprise",
195+
"install_type": "fullstack",
196+
"working_directory": "solutions/enterprise",
197+
"configuration": [
198+
{
199+
"key": "ibmcloud_api_key"
200+
},
201+
{
202+
"key": "provider_visibility",
203+
"options": [
204+
{
205+
"displayname": "private",
206+
"value": "private"
207+
},
208+
{
209+
"displayname": "public",
210+
"value": "public"
211+
},
212+
{
213+
"displayname": "public-and-private",
214+
"value": "public-and-private"
215+
}
216+
]
217+
},
218+
{
219+
"key": "prefix",
220+
"required": true
221+
},
222+
{
223+
"key": "use_existing_resource_group"
224+
},
225+
{
226+
"key": "resource_group_name"
227+
},
228+
{
229+
"key": "event_streams_name"
230+
},
231+
{
232+
"key": "region",
233+
"required": true,
234+
"options": [
235+
{
236+
"displayname": "Dallas (us-south)",
237+
"value": "us-south"
238+
},
239+
{
240+
"displayname": "Frankfurt (eu-de)",
241+
"value": "eu-de"
242+
},
243+
{
244+
"displayname": "London (eu-gb)",
245+
"value": "eu-gb"
246+
},
247+
{
248+
"displayname": "Madrid (eu-es)",
249+
"value": "eu-es"
250+
},
251+
{
252+
"displayname": "Osaka (jp-osa)",
253+
"value": "jp-osa"
254+
},
255+
{
256+
"displayname": "Sydney (au-syd)",
257+
"value": "au-syd"
258+
},
259+
{
260+
"displayname": "Tokyo (jp-tok)",
261+
"value": "jp-tok"
262+
},
263+
{
264+
"displayname": "Osaka (jp-osa)",
265+
"value": "jp-osa"
266+
},
267+
{
268+
"displayname": "Sao Paulo (br-sao)",
269+
"value": "br-sao"
270+
},
271+
{
272+
"displayname": "Toronto (ca-tor)",
273+
"value": "ca-tor"
274+
},
275+
{
276+
"displayname": "Washington (us-east)",
277+
"value": "us-east"
278+
}
279+
]
280+
},
281+
{
282+
"key": "resource_tags"
283+
},
284+
{
285+
"key": "access_tags"
286+
},
287+
{
288+
"key": "schemas"
289+
},
290+
{
291+
"key": "schema_global_rule"
292+
},
293+
{
294+
"key": "topics"
295+
},
296+
{
297+
"key": "skip_event_streams_s2s_iam_auth_policy"
298+
},
299+
{
300+
"key": "cbr_rules"
301+
},
302+
{
303+
"key": "service_credential_names"
304+
},
305+
{
306+
"key": "quotas"
307+
},
308+
{
309+
"key": "metrics"
310+
},
311+
{
312+
"key": "mirroring_topic_patterns"
313+
},
314+
{
315+
"key": "mirroring"
316+
},
317+
{
318+
"key": "event_streams_key_name"
319+
},
320+
{
321+
"key": "event_streams_key_ring_name"
322+
},
323+
{
324+
"key": "existing_kms_instance_crn"
325+
},
326+
{
327+
"key": "ibmcloud_kms_api_key"
328+
},
329+
{
330+
"key": "kms_endpoint_type"
331+
},
332+
{
333+
"key": "skip_event_streams_kms_auth_policy"
334+
},
335+
{
336+
"key": "existing_kms_key_crn"
337+
}
338+
],
339+
"iam_permissions": [
340+
{
341+
"role_crns": [
342+
"crn:v1:bluemix:public:iam::::serviceRole:Manager"
343+
],
344+
"service_name": "messagehub"
345+
},
346+
{
347+
"role_crns": [
348+
"crn:v1:bluemix:public:iam::::role:Editor"
349+
],
350+
"service_name": "messagehub"
351+
}
352+
],
353+
"architecture": {
354+
"descriptions": "This architecture creates a Financial Services compliant instance of IBM Event Streams for IBM Cloud in enterprise plan. It also supports the creation of topics and schemas in the Event Streams instance.",
355+
"features": [
356+
{
357+
"title": "Creates an Event Streams instance",
358+
"description": "Creates and configures the IBM Cloud Event Streams instance."
359+
},
360+
{
361+
"title": "Creates topics in the Event Streams instance",
362+
"description": "Creates topics in IBM Cloud Event Streams instance."
363+
},
364+
{
365+
"title": "Creates schemas in the Event Streams instance",
366+
"description": "Creates schemas in IBM Cloud Event Streams instance."
367+
},
368+
{
369+
"title": "Supports mirroring",
370+
"description": "Supports mirroring which enables messages in one Event Streams service instance to be continuously copied to a second instance."
371+
},
372+
{
373+
"title": "Suports quotas.",
374+
"description": "Supports quotas to control the resources, such as network bandwidth, that a service can consume.."
375+
},
376+
{
377+
"title": "CBR",
378+
"description": "Create context-based restriction (CBR) rules for Event Streams instance."
379+
},
380+
{
381+
"title": "Encrypt messages with key management services",
382+
"description": "Supports key management encryption (BYOK and KYOK)."
383+
},
384+
{
385+
"title": "Managing users and roles",
386+
"description": "Manage IAM service credentials for Event Streams."
387+
}
388+
],
389+
"diagrams": [
390+
{
391+
"diagram": {
392+
"caption": "Financial Services compliant instance of IBM Event Streams for IBM Cloud.",
393+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-event-streams/main/reference-architecture/da-enterprise.svg",
394+
"type": "image/svg+xml"
395+
},
396+
"description": "This architecture creates a Financial Services compliant instance of IBM Event Streams for IBM Cloud."
397+
}
398+
]
399+
}
170400
}
171401
]
172402
}

0 commit comments

Comments
 (0)