You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: Support for managing the service to service KMS authorization policy has been removed from this module. For more infomation on why, see [About KMS encryption](https://github.com/terraform-ibm-modules/terraform-ibm-event-streams/tree/main?tab=readme-ov-file#about-kms-encryption). This now means that the auth policy must be in place before you attempt to provision an Event Streams instance with KMS encryption enabled.<br>* Due to this change, the following variables have bee removed skip_iam_authorization_policy, existing_kms_instance_guid, and kms_encryption_enabled. If you wish to enable KMS encryption, just pass a value for the kms_key_crn input variable. (#178)
BREAKING CHANGE: If updating to this version from a previous version, and if you were using the module to manage the KMS auth policy, you will see the auth policy as identified for destroy. In order to ensure there is no interruption to service when updating, it is recommended that you create a global auth policy (outside of this terraform state) to allow all Event Stream instances in your account read access to the KMS service you are using before you proceed with upgrade. Once your upgrade is complete, and terraform has destroyed the old auth policy, you may wish to create a new instance-to-instance scoped policy if you wish to remove the globally scoped one. It is important not to create the policy with Terraform if it shares the same state as this module. Refer to [About KMS encryption](https://github.com/terraform-ibm-modules/terraform-ibm-event-streams/tree/main?tab=readme-ov-file#about-kms-encryption) for more details.
This module implements Event Streams with topics, partitions, throughput, storage size, cleanup policy, retention time, retention size, segment size and schema.
9
+
This module implements Event Streams with topics, partitions, throughput, storage size, cleanup policy, retention time, retention size, segment size, and schema.
10
+
11
+
## About KMS encryption
12
+
13
+
The Event Streams service supports payload data encryption that uses a root key CRN of a key management service, such as Key Protect or Hyper Protect Crypto Services (HPCS). You specify the root key CRN with the `kms_key_crn` input. For more information, see [Managing encryption in Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption).
14
+
15
+
Before you run the module, configure an authorization policy to allow the Event Streams service to access the key management service instance with the reader role. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth).
16
+
17
+
You can't manage the policy in the same Terraform state file as the Event Streams service instance. When you issue a `terraform destroy` command, the instance is only soft deleted and remains as a reclamation resource for a while to support recovery (reclamation). An authorization policy must exist when the instance is hard deleted or reclaimed or else the unregistration of the instance from the root key fails on the backend. If the policy doesn't exist, the only way to unregister the instance, which is a requirement for deletion of the root key, is by opening a support case. For more information, see [Using a customer-managed key](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption#using_encryption).
10
18
11
19
<!-- Below content is automatically populated via pre-commit hook -->
12
20
<!-- BEGIN OVERVIEW HOOK -->
@@ -106,7 +114,6 @@ You need the following permissions to run this module.
@@ -132,15 +137,12 @@ You need the following permissions to run this module.
132
137
| <aname="input_create_timeout"></a> [create\_timeout](#input\_create\_timeout)| Creation timeout value of the Event Streams module. Use 3h when creating enterprise instance, add more 1h for each level of non-default throughput, add more 30m for each level of non-default storage\_size |`string`|`"3h"`| no |
133
138
| <aname="input_delete_timeout"></a> [delete\_timeout](#input\_delete\_timeout)| Deleting timeout value of the Event Streams module |`string`|`"15m"`| no |
134
139
| <aname="input_es_name"></a> [es\_name](#input\_es\_name)| The name to give the IBM Event Streams instance created by this module. |`string`| n/a | yes |
135
-
| <aname="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid)| The GUID of the Hyper Protect Crypto Services or Key Protect instance in which the key specified in var.kms\_key\_crn is coming from. Required only if var.kms\_encryption\_enabled is set to true, var.skip\_iam\_authorization\_policy is set to false, and you pass a value for var.kms\_key\_crn. |`string`|`null`| no |
136
-
| <aname="input_kms_encryption_enabled"></a> [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled)| Set this to true to control the encryption keys used to encrypt the data that you store in IBM Cloud® Databases. If set to false, the data is encrypted by using randomly generated keys. For more info on Key Protect integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect. For more info on HPCS integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs|`bool`|`false`| no |
137
-
| <aname="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn)| The root key CRN of a Key Management Services like Key Protect or Hyper Protect Crypto Services (HPCS) that you want to use for disk encryption. Only used if var.kms\_encryption\_enabled is set to true. |`string`|`null`| no |
140
+
| <aname="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn)| The root key CRN of a Key Management Services like Key Protect or Hyper Protect Crypto Services (HPCS) that you want to use payload data encryption. Only used if var.kms\_encryption\_enabled is set to true. Note an authorization policy to allow the Event Streams service to access the key management service instance as a Reader MUST be configured in advance and should not be managed as part of the same terraform state as the event streams instance, see https://cloud.ibm.com/docs/account?topic=account-serviceauth|`string`|`null`| no |
138
141
| <aname="input_plan"></a> [plan](#input\_plan)| Plan for the event streams instance : lite, standard or enterprise-3nodes-2tb |`string`|`"standard"`| no |
139
142
| <aname="input_region"></a> [region](#input\_region)| IBM Cloud region where event streams will be created |`string`|`"us-south"`| no |
140
143
| <aname="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id)| The resource group ID where the Event Streams instance will be created. |`string`| n/a | yes |
141
144
| <aname="input_schemas"></a> [schemas](#input\_schemas)| The list of schema object which contains schema id and format of the schema | <pre>list(object(<br> {<br> schema_id = string<br> schema = object({<br> type = string<br> name = string<br> })<br> }<br> ))</pre> |`[]`| no |
142
145
| <aname="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints)| Specify whether you want to enable the public, private, or both service endpoints. Supported values are 'public', 'private', or 'public-and-private'. |`string`|`"public"`| no |
143
-
| <aname="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy)| Set to true to skip the creation of an IAM authorization policy that permits all Event Streams database instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the existing\_kms\_instance\_guid variable. In addition, no policy is created if var.kms\_encryption\_enabled is set to false. |`bool`|`false`| no |
144
146
| <aname="input_storage_size"></a> [storage\_size](#input\_storage\_size)| Storage size of the event streams in GB. For enterprise instance only. Options are: 2048, 4096, 6144, 8192, 10240, 12288,. Note: When throughput is 300, storage\_size starts from 4096, when throughput is 450, storage\_size starts from 6144. Storage capacity cannot be scaled down once instance is created. |`number`|`"2048"`| no |
145
147
| <aname="input_tags"></a> [tags](#input\_tags)| List of tags associated with the Event Steams instance |`list(string)`|`[]`| no |
146
148
| <aname="input_throughput"></a> [throughput](#input\_throughput)| Throughput capacity in MB per second. For enterprise instance only. Options are: 150, 300, 450. |`number`|`"150"`| no |
Copy file name to clipboardexpand all lines: examples/fscloud/variables.tf
-5
Original file line number
Diff line number
Diff line change
@@ -54,11 +54,6 @@ variable "topics" {
54
54
default=[]
55
55
}
56
56
57
-
variable"existing_kms_instance_guid" {
58
-
description="The GUID of the Hyper Protect Crypto service in which the key specified in var.kms_key_crn is coming from"
59
-
type=string
60
-
}
61
-
62
57
variable"kms_key_crn" {
63
58
type=string
64
59
description="The root key CRN of a Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs&interface=ui for more information on integrating HPCS with Event Streams instance."
Copy file name to clipboardexpand all lines: main.tf
+1-35
Original file line number
Diff line number
Diff line change
@@ -5,33 +5,14 @@
5
5
locals {
6
6
# Validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
7
7
# tflint-ignore: terraform_unused_declarations
8
-
validate_kms_plan=var.kms_encryption_enabled&& var.plan!="enterprise-3nodes-2tb"?tobool("kms encryption is only supported for enterprise plan") :true
9
-
# tflint-ignore: terraform_unused_declarations
10
-
validate_kms_values=!var.kms_encryption_enabled&& var.kms_key_crn!=null?tobool("When passing values for var.kms_key_crn, you must set var.kms_encryption_enabled to true. Otherwise unset them to use default encryption") :true
11
-
# tflint-ignore: terraform_unused_declarations
12
-
validate_kms_vars=var.kms_encryption_enabled&& var.kms_key_crn==null?tobool("When setting var.kms_encryption_enabled to true, a value must be passed for var.kms_key_crn and/or var.backup_encryption_key_crn") :true
13
-
# tflint-ignore: terraform_unused_declarations
14
-
validate_auth_policy=var.kms_encryption_enabled&& var.skip_iam_authorization_policy==false&& var.existing_kms_instance_guid==null?tobool("When var.skip_iam_authorization_policy is set to false, and var.kms_encryption_enabled to true, a value must be passed for var.existing_kms_instance_guid in order to create the auth policy.") :true
8
+
validate_kms_plan=var.kms_key_crn!=null&& var.plan!="enterprise-3nodes-2tb"?tobool("kms encryption is only supported for enterprise plan") :true
15
9
# tflint-ignore: terraform_unused_declarations
16
10
validate_throughput_lite_standard=((var.plan=="lite"|| var.plan=="standard") && var.throughput!=150) ?tobool("Throughput value cannot be changed in lite and standard plan. Default value is 150.") :true
17
11
# tflint-ignore: terraform_unused_declarations
18
12
validate_storage_size_lite_standard=((var.plan=="lite"|| var.plan=="standard") && var.storage_size!=2048) ?tobool("Storage size value cannot be changed in lite and standard plan. Default value is 2048.") :true
19
13
# tflint-ignore: terraform_unused_declarations
20
14
validate_service_end_points_lite_standard=((var.plan=="lite"|| var.plan=="standard") && var.service_endpoints!="public") ?tobool("Service endpoint cannot be changed in lite and standard plan. Default is public.") :true
21
15
22
-
# Determine what KMS service is being used for database encryption
description="Allow all Event Streams instances in the resource group ${var.resource_group_id} to read from the ${local.kms_service} instance GUID ${var.existing_kms_instance_guid}"
Copy file name to clipboardexpand all lines: modules/fscloud/README.md
+8-5
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,12 @@
1
-
# Financial Services Cloud Profile
1
+
# Profile for IBM Cloud Framework for Financial Services
2
2
3
-
This is a profile for Event Streams that meets Financial Services Cloud requirements.
4
-
It has been scanned by [IBM Code Risk Analyzer (CRA)](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-plugin#terraform-command) and meets all applicable goals.
3
+
This code is a version of the [parent root module](../../) that includes a default configuration that complies with the relevant controls from the [IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about). See the [Example for IBM Cloud Framework for Financial Services](/examples/fscloud/) for logic that uses this module. The profile assumes you are deploying into an account that complies with the framework.
4
+
5
+
The default values in this profile were scanned by [IBM Code Risk Analyzer (CRA)](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-plugin#terraform-command) for compliance with the IBM Cloud Framework for Financial Services profile that is specified by the IBM Security and Compliance Center. The scan passed for all applicable rules.
6
+
7
+
## Before you begin
8
+
9
+
Before you run the module, configure an authorization policy to allow the Event Streams service to access the key management service instance with the reader role. For more information, see [About KMS encryption](../../README.md#about-kms-encryption) in the main readme file.
5
10
6
11
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
| <aname="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules)| (Optional, list) List of CBR rules to create | <pre>list(object({<br> description = string<br> account_id = string<br> rule_contexts = list(object({<br> attributes = optional(list(object({<br> name = string<br> value = string<br> }))) }))<br> enforcement_mode = string<br> }))</pre> |`[]`| no |
29
34
| <aname="input_es_name"></a> [es\_name](#input\_es\_name)| Name of the event streams instance |`string`| n/a | yes |
30
-
| <aname="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid)| The GUID of the Hyper Protect Crypto Services instance. |`string`| n/a | yes |
31
35
| <aname="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn)| The root key CRN of the Hyper Protect Crypto Service (HPCS) to use for disk encryption. |`string`| n/a | yes |
32
36
| <aname="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id)| ID of resource group to use when creating the event stream instance |`string`| n/a | yes |
33
37
| <aname="input_schemas"></a> [schemas](#input\_schemas)| The list of schema object which contains schema id and format of the schema | <pre>list(object(<br> {<br> schema_id = string<br> schema = object({<br> type = string<br> name = string<br> })<br> }<br> ))</pre> |`[]`| no |
34
-
| <aname="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy)| Set to true to skip the creation of an IAM authorization policy that permits all event streams instances in the provided resource group reader access to the instance specified in the existing\_kms\_instance\_guid variable. |`bool`|`false`| no |
35
38
| <aname="input_tags"></a> [tags](#input\_tags)| List of tags associated with the Event Steams instance |`list(string)`|`[]`| no |
36
39
| <aname="input_topics"></a> [topics](#input\_topics)| List of topics. For lite plan only one topic is allowed. | <pre>list(object(<br> {<br> name = string<br> partitions = number<br> config = object({})<br> }<br> ))</pre> |`[]`| no |
0 commit comments