Skip to content

Commit f10901f

Browse files
akocbekakocbek
authored
chore: add DA for fscloud (#181)
1 parent f665852 commit f10901f

File tree

17 files changed

+214
-184
lines changed

17 files changed

+214
-184
lines changed

‎README.md

-4
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@ You can't manage the policy in the same Terraform state file as the Event Stream
2323
* [Submodules](./modules)
2424
* [fscloud](./modules/fscloud)
2525
* [Examples](./examples)
26-
* [ Financial Services Cloud profile example](./examples/fscloud)
2726
* [Basic example](./examples/basic)
2827
* [Complete example with topics and schema creation.](./examples/complete)
2928
* [Contributing](#contributing)
@@ -100,9 +99,6 @@ You need the following permissions to run this module.
10099
- **Resource Group** service
101100
- `Viewer` platform access
102101
- IAM Services
103-
- **IBM Authorization Policy**
104-
- `Editor` platform access
105-
- `Manager` service access
106102
- **Event Streams** service
107103
- `Editor` platform access
108104
- `Manager` service access

‎cra-config.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
22
version: "v1"
33
CRA_TARGETS:
4-
- CRA_TARGET: "examples/fscloud" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4+
- CRA_TARGET: "examples/complete" # Target directory for CRA scan. If not provided, the CRA Scan will not be run.
55
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json" # CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
66
PROFILE_ID: "0e6e7b5a-817d-4344-ab6f-e5d7a9c49520" # SCC profile ID (currently set to the FSCloud 1.4.0 profile).
77
CRA_ENVIRONMENT_VARIABLES:

‎examples/complete/README.md

+2
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,6 @@
33
An end-to-end example that creates an event streams instance.
44
This example uses the IBM Cloud terraform provider to:
55
- Create a new resource group if one is not passed in.
6+
- A sample virtual private cloud (VPC).
7+
- A context-based restriction (CBR) rule to only allow Event Streams to be accessible from within the VPC.
68
- Create a new event streams instance in the resource group and region provided along with configured topics and schemas.

‎examples/complete/main.tf

+57
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,45 @@ module "resource_group" {
1010
existing_resource_group_name = var.resource_group
1111
}
1212

13+
##############################################################################
14+
# Get Cloud Account ID
15+
##############################################################################
16+
17+
data "ibm_iam_account_settings" "iam_account_settings" {
18+
}
19+
20+
##############################################################################
21+
# VPC
22+
##############################################################################
23+
resource "ibm_is_vpc" "example_vpc" {
24+
name = "${var.prefix}-vpc"
25+
resource_group = module.resource_group.resource_group_id
26+
tags = var.resource_tags
27+
}
28+
29+
resource "ibm_is_subnet" "testacc_subnet" {
30+
name = "${var.prefix}-subnet"
31+
vpc = ibm_is_vpc.example_vpc.id
32+
zone = "${var.region}-1"
33+
total_ipv4_address_count = 256
34+
resource_group = module.resource_group.resource_group_id
35+
}
36+
37+
##############################################################################
38+
# Create CBR Zone
39+
##############################################################################
40+
module "cbr_zone" {
41+
source = "terraform-ibm-modules/cbr/ibm//modules/cbr-zone-module"
42+
version = "1.18.0"
43+
name = "${var.prefix}-VPC-network-zone"
44+
zone_description = "CBR Network zone representing VPC"
45+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
46+
addresses = [{
47+
type = "vpc", # to bind a specific vpc to the zone
48+
value = ibm_is_vpc.example_vpc.crn,
49+
}]
50+
}
51+
1352
##############################################################################
1453
# Events-streams-instance
1554
##############################################################################
@@ -21,4 +60,22 @@ module "event_streams" {
2160
schemas = var.schemas
2261
tags = var.resource_tags
2362
topics = var.topics
63+
cbr_rules = [
64+
{
65+
description = "${var.prefix}-event stream access only from vpc"
66+
enforcement_mode = "enabled"
67+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
68+
rule_contexts = [{
69+
attributes = [
70+
{
71+
"name" : "endpointType",
72+
"value" : "private"
73+
},
74+
{
75+
name = "networkZoneId"
76+
value = module.cbr_zone.zone_id
77+
}]
78+
}]
79+
}
80+
]
2481
}

‎examples/fscloud/README.md

-17
This file was deleted.

‎examples/fscloud/main.tf

-82
This file was deleted.

‎examples/fscloud/variables.tf

-60
This file was deleted.

‎modules/fscloud/README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# Profile for IBM Cloud Framework for Financial Services
22

3-
This code is a version of the [parent root module](../../) that includes a default configuration that complies with the relevant controls from the [IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about). See the [Example for IBM Cloud Framework for Financial Services](/examples/fscloud/) for logic that uses this module. The profile assumes you are deploying into an account that complies with the framework.
3+
This code is a version of the [parent root module](../../) that includes a default configuration that complies with the relevant controls from the [IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about). See the [Solution for IBM Cloud Framework for Financial Services](/solutions/fscloud/) for logic that uses this module. The profile assumes you are deploying into an account that complies with the framework.
44

55
The default values in this profile were scanned by [IBM Code Risk Analyzer (CRA)](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-plugin#terraform-command) for compliance with the IBM Cloud Framework for Financial Services profile that is specified by the IBM Security and Compliance Center. The scan passed for all applicable rules.
66

‎reference-architecture/da-fscloud.svg

+4
Loading

‎renovate.json

+15-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
{
22
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3-
"extends": ["local>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"]
3+
"extends": ["local>terraform-ibm-modules/common-dev-assets:commonRenovateConfig"],
4+
"packageRules": [
5+
{
6+
"description": "Allow the locked in provider version to be updated to the latest for DAs",
7+
"enabled": true,
8+
"matchFileNames": ["solutions/fscloud/**"],
9+
"matchManagers": ["terraform"],
10+
"matchDepTypes": ["required_provider"],
11+
"rangeStrategy": "bump",
12+
"semanticCommitType": "fix",
13+
"group": true,
14+
"groupName": "required_provider",
15+
"commitMessageExtra": "to latest for the DA solution"
16+
}
17+
]
418
}

‎solutions/fscloud/README.md

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Event Streams for IBM Cloud - Financial Services Cloud solution
2+
3+
This architecture creates an Event Streams for IBM Cloud Enterprise plan instance which is IBM Cloud® Financial Services certified. The solution supports provisioning the following resources:
4+
5+
- (Optional) A resource group
6+
- An Event Streams for IBM Cloud Enterprise plan instance, set up with KMS encryption to encrypt data.
7+
- (Optional) Topics
8+
- (Optional) Schemas
9+
- Context Based Restriction rules for the instance
10+
11+
![da-fscloud](../../reference-architecture/da-fscloud.svg)
12+
13+
## Before you begin
14+
15+
To deploy your Event Streams instance you need:
16+
- Hyper Protect Crypto Services instance,
17+
- root key CRN of a Hyper Protect Crypto Services instance and
18+
- configure an authorization policy to allow the Event Streams service to access the Hyper Protect Crypto Services instance.

‎solutions/fscloud/main.tf

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
module "resource_group" {
2+
source = "terraform-ibm-modules/resource-group/ibm"
3+
version = "1.1.4"
4+
resource_group_name = var.existing_resource_group == false ? var.resource_group_name : null
5+
existing_resource_group_name = var.existing_resource_group == true ? var.resource_group_name : null
6+
}
7+
8+
module "event_streams" {
9+
source = "../../modules/fscloud"
10+
resource_group_id = module.resource_group.resource_group_id
11+
es_name = var.es_name
12+
kms_key_crn = var.kms_key_crn
13+
schemas = var.schemas
14+
topics = var.topics
15+
tags = var.resource_tags
16+
cbr_rules = var.cbr_rules
17+
}

‎examples/fscloud/outputs.tf ‎solutions/fscloud/outputs.tf

File renamed without changes.

‎examples/fscloud/provider.tf ‎solutions/fscloud/provider.tf

File renamed without changes.

0 commit comments

Comments
 (0)