Skip to content

Commit f665852

Browse files
feat: Support for managing the service to service KMS authorization policy has been removed from this module. For more infomation on why, see [About KMS encryption](https://github.com/terraform-ibm-modules/terraform-ibm-event-streams/tree/main?tab=readme-ov-file#about-kms-encryption). This now means that the auth policy must be in place before you attempt to provision an Event Streams instance with KMS encryption enabled.<br>* Due to this change, the following variables have bee removed skip_iam_authorization_policy, existing_kms_instance_guid, and kms_encryption_enabled. If you wish to enable KMS encryption, just pass a value for the kms_key_crn input variable. (#178)
BREAKING CHANGE: If updating to this version from a previous version, and if you were using the module to manage the KMS auth policy, you will see the auth policy as identified for destroy. In order to ensure there is no interruption to service when updating, it is recommended that you create a global auth policy (outside of this terraform state) to allow all Event Stream instances in your account read access to the KMS service you are using before you proceed with upgrade. Once your upgrade is complete, and terraform has destroyed the old auth policy, you may wish to create a new instance-to-instance scoped policy if you wish to remove the globally scoped one. It is important not to create the policy with Terraform if it shares the same state as this module. Refer to [About KMS encryption](https://github.com/terraform-ibm-modules/terraform-ibm-event-streams/tree/main?tab=readme-ov-file#about-kms-encryption) for more details.
1 parent 738d25f commit f665852

File tree

10 files changed

+39
-111
lines changed

10 files changed

+39
-111
lines changed

README.md

+11-9
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
1-
# Event Streams Module
1+
# Event Streams module
22

33
[![Graduated (Supported)](https://img.shields.io/badge/Status-Graduated%20(Supported)-brightgreen)](https://terraform-ibm-modules.github.io/documentation/#/badge-status)
44
[![semantic-release](https://img.shields.io/badge/%20%20%F0%9F%93%A6%F0%9F%9A%80-semantic--release-e10079.svg)](https://github.com/semantic-release/semantic-release)
55
[![pre-commit](https://img.shields.io/badge/pre--commit-enabled-brightgreen?logo=pre-commit&logoColor=white)](https://github.com/pre-commit/pre-commit)
66
[![latest release](https://img.shields.io/github/v/release/terraform-ibm-modules/terraform-ibm-event-streams?logo=GitHub&sort=semver)](https://github.com/terraform-ibm-modules/terraform-ibm-event-streams/releases/latest)
77
[![Renovate enabled](https://img.shields.io/badge/renovate-enabled-brightgreen.svg)](https://renovatebot.com/)
88

9-
This module implements Event Streams with topics, partitions, throughput, storage size, cleanup policy, retention time, retention size, segment size and schema.
9+
This module implements Event Streams with topics, partitions, throughput, storage size, cleanup policy, retention time, retention size, segment size, and schema.
10+
11+
## About KMS encryption
12+
13+
The Event Streams service supports payload data encryption that uses a root key CRN of a key management service, such as Key Protect or Hyper Protect Crypto Services (HPCS). You specify the root key CRN with the `kms_key_crn` input. For more information, see [Managing encryption in Event Streams](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption).
14+
15+
Before you run the module, configure an authorization policy to allow the Event Streams service to access the key management service instance with the reader role. For more information, see [Using authorizations to grant access between services](https://cloud.ibm.com/docs/account?topic=account-serviceauth).
16+
17+
You can't manage the policy in the same Terraform state file as the Event Streams service instance. When you issue a `terraform destroy` command, the instance is only soft deleted and remains as a reclamation resource for a while to support recovery (reclamation). An authorization policy must exist when the instance is hard deleted or reclaimed or else the unregistration of the instance from the root key fails on the backend. If the policy doesn't exist, the only way to unregister the instance, which is a requirement for deletion of the root key, is by opening a support case. For more information, see [Using a customer-managed key](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption#using_encryption).
1018

1119
<!-- Below content is automatically populated via pre-commit hook -->
1220
<!-- BEGIN OVERVIEW HOOK -->
@@ -106,7 +114,6 @@ You need the following permissions to run this module.
106114
|------|---------|
107115
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0, <1.6.0 |
108116
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.56.1, < 2.0.0 |
109-
| <a name="requirement_time"></a> [time](#requirement\_time) | >= 0.9.1 |
110117

111118
### Modules
112119

@@ -120,9 +127,7 @@ You need the following permissions to run this module.
120127
|------|------|
121128
| [ibm_event_streams_schema.es_schema](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/event_streams_schema) | resource |
122129
| [ibm_event_streams_topic.es_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/event_streams_topic) | resource |
123-
| [ibm_iam_authorization_policy.kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
124130
| [ibm_resource_instance.es_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_instance) | resource |
125-
| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
126131

127132
### Inputs
128133

@@ -132,15 +137,12 @@ You need the following permissions to run this module.
132137
| <a name="input_create_timeout"></a> [create\_timeout](#input\_create\_timeout) | Creation timeout value of the Event Streams module. Use 3h when creating enterprise instance, add more 1h for each level of non-default throughput, add more 30m for each level of non-default storage\_size | `string` | `"3h"` | no |
133138
| <a name="input_delete_timeout"></a> [delete\_timeout](#input\_delete\_timeout) | Deleting timeout value of the Event Streams module | `string` | `"15m"` | no |
134139
| <a name="input_es_name"></a> [es\_name](#input\_es\_name) | The name to give the IBM Event Streams instance created by this module. | `string` | n/a | yes |
135-
| <a name="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of the Hyper Protect Crypto Services or Key Protect instance in which the key specified in var.kms\_key\_crn is coming from. Required only if var.kms\_encryption\_enabled is set to true, var.skip\_iam\_authorization\_policy is set to false, and you pass a value for var.kms\_key\_crn. | `string` | `null` | no |
136-
| <a name="input_kms_encryption_enabled"></a> [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set this to true to control the encryption keys used to encrypt the data that you store in IBM Cloud® Databases. If set to false, the data is encrypted by using randomly generated keys. For more info on Key Protect integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect. For more info on HPCS integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs | `bool` | `false` | no |
137-
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of a Key Management Services like Key Protect or Hyper Protect Crypto Services (HPCS) that you want to use for disk encryption. Only used if var.kms\_encryption\_enabled is set to true. | `string` | `null` | no |
140+
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of a Key Management Services like Key Protect or Hyper Protect Crypto Services (HPCS) that you want to use payload data encryption. Only used if var.kms\_encryption\_enabled is set to true. Note an authorization policy to allow the Event Streams service to access the key management service instance as a Reader MUST be configured in advance and should not be managed as part of the same terraform state as the event streams instance, see https://cloud.ibm.com/docs/account?topic=account-serviceauth | `string` | `null` | no |
138141
| <a name="input_plan"></a> [plan](#input\_plan) | Plan for the event streams instance : lite, standard or enterprise-3nodes-2tb | `string` | `"standard"` | no |
139142
| <a name="input_region"></a> [region](#input\_region) | IBM Cloud region where event streams will be created | `string` | `"us-south"` | no |
140143
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where the Event Streams instance will be created. | `string` | n/a | yes |
141144
| <a name="input_schemas"></a> [schemas](#input\_schemas) | The list of schema object which contains schema id and format of the schema | <pre>list(object(<br> {<br> schema_id = string<br> schema = object({<br> type = string<br> name = string<br> })<br> }<br> ))</pre> | `[]` | no |
142145
| <a name="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints) | Specify whether you want to enable the public, private, or both service endpoints. Supported values are 'public', 'private', or 'public-and-private'. | `string` | `"public"` | no |
143-
| <a name="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Event Streams database instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the existing\_kms\_instance\_guid variable. In addition, no policy is created if var.kms\_encryption\_enabled is set to false. | `bool` | `false` | no |
144146
| <a name="input_storage_size"></a> [storage\_size](#input\_storage\_size) | Storage size of the event streams in GB. For enterprise instance only. Options are: 2048, 4096, 6144, 8192, 10240, 12288,. Note: When throughput is 300, storage\_size starts from 4096, when throughput is 450, storage\_size starts from 6144. Storage capacity cannot be scaled down once instance is created. | `number` | `"2048"` | no |
145147
| <a name="input_tags"></a> [tags](#input\_tags) | List of tags associated with the Event Steams instance | `list(string)` | `[]` | no |
146148
| <a name="input_throughput"></a> [throughput](#input\_throughput) | Throughput capacity in MB per second. For enterprise instance only. Options are: 150, 300, 450. | `number` | `"150"` | no |

examples/fscloud/main.tf

+7-8
Original file line numberDiff line numberDiff line change
@@ -54,14 +54,13 @@ module "cbr_zone" {
5454
# #############################################################################
5555

5656
module "event_streams" {
57-
source = "../../modules/fscloud"
58-
resource_group_id = module.resource_group.resource_group_id
59-
es_name = "${var.prefix}-es-fs"
60-
kms_key_crn = var.kms_key_crn
61-
existing_kms_instance_guid = var.existing_kms_instance_guid
62-
schemas = var.schemas
63-
tags = var.resource_tags
64-
topics = var.topics
57+
source = "../../modules/fscloud"
58+
resource_group_id = module.resource_group.resource_group_id
59+
es_name = "${var.prefix}-es-fs"
60+
kms_key_crn = var.kms_key_crn
61+
schemas = var.schemas
62+
tags = var.resource_tags
63+
topics = var.topics
6564
cbr_rules = [
6665
{
6766
description = "${var.prefix}-event stream access only from vpc"

examples/fscloud/variables.tf

-5
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,6 @@ variable "topics" {
5454
default = []
5555
}
5656

57-
variable "existing_kms_instance_guid" {
58-
description = "The GUID of the Hyper Protect Crypto service in which the key specified in var.kms_key_crn is coming from"
59-
type = string
60-
}
61-
6257
variable "kms_key_crn" {
6358
type = string
6459
description = "The root key CRN of a Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs&interface=ui for more information on integrating HPCS with Event Streams instance."

main.tf

+1-35
Original file line numberDiff line numberDiff line change
@@ -5,33 +5,14 @@
55
locals {
66
# Validation (approach based on https://github.com/hashicorp/terraform/issues/25609#issuecomment-1057614400)
77
# tflint-ignore: terraform_unused_declarations
8-
validate_kms_plan = var.kms_encryption_enabled && var.plan != "enterprise-3nodes-2tb" ? tobool("kms encryption is only supported for enterprise plan") : true
9-
# tflint-ignore: terraform_unused_declarations
10-
validate_kms_values = !var.kms_encryption_enabled && var.kms_key_crn != null ? tobool("When passing values for var.kms_key_crn, you must set var.kms_encryption_enabled to true. Otherwise unset them to use default encryption") : true
11-
# tflint-ignore: terraform_unused_declarations
12-
validate_kms_vars = var.kms_encryption_enabled && var.kms_key_crn == null ? tobool("When setting var.kms_encryption_enabled to true, a value must be passed for var.kms_key_crn and/or var.backup_encryption_key_crn") : true
13-
# tflint-ignore: terraform_unused_declarations
14-
validate_auth_policy = var.kms_encryption_enabled && var.skip_iam_authorization_policy == false && var.existing_kms_instance_guid == null ? tobool("When var.skip_iam_authorization_policy is set to false, and var.kms_encryption_enabled to true, a value must be passed for var.existing_kms_instance_guid in order to create the auth policy.") : true
8+
validate_kms_plan = var.kms_key_crn != null && var.plan != "enterprise-3nodes-2tb" ? tobool("kms encryption is only supported for enterprise plan") : true
159
# tflint-ignore: terraform_unused_declarations
1610
validate_throughput_lite_standard = ((var.plan == "lite" || var.plan == "standard") && var.throughput != 150) ? tobool("Throughput value cannot be changed in lite and standard plan. Default value is 150.") : true
1711
# tflint-ignore: terraform_unused_declarations
1812
validate_storage_size_lite_standard = ((var.plan == "lite" || var.plan == "standard") && var.storage_size != 2048) ? tobool("Storage size value cannot be changed in lite and standard plan. Default value is 2048.") : true
1913
# tflint-ignore: terraform_unused_declarations
2014
validate_service_end_points_lite_standard = ((var.plan == "lite" || var.plan == "standard") && var.service_endpoints != "public") ? tobool("Service endpoint cannot be changed in lite and standard plan. Default is public.") : true
2115

22-
# Determine what KMS service is being used for database encryption
23-
kms_service = var.kms_key_crn != null ? (
24-
can(regex(".*kms.*", var.kms_key_crn)) ? "kms" : (
25-
can(regex(".*hs-crypto.*", var.kms_key_crn)) ? "hs-crypto" : null
26-
)
27-
) : null
28-
}
29-
30-
# workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4478
31-
resource "time_sleep" "wait_for_authorization_policy" {
32-
depends_on = [ibm_iam_authorization_policy.kms_policy]
33-
34-
create_duration = "30s"
3516
}
3617

3718
resource "ibm_resource_instance" "es_instance" {
@@ -79,21 +60,6 @@ resource "ibm_event_streams_topic" "es_topic" {
7960
}
8061

8162

82-
##############################################################################
83-
# IAM Authorization Policy
84-
##############################################################################
85-
86-
# Create IAM Authorization Policies to allow messagehub to access kms for the encryption key
87-
resource "ibm_iam_authorization_policy" "kms_policy" {
88-
count = var.kms_encryption_enabled == false || var.skip_iam_authorization_policy ? 0 : 1
89-
source_service_name = "messagehub"
90-
source_resource_group_id = var.resource_group_id
91-
target_service_name = local.kms_service
92-
target_resource_instance_id = var.existing_kms_instance_guid
93-
roles = ["Reader"]
94-
description = "Allow all Event Streams instances in the resource group ${var.resource_group_id} to read from the ${local.kms_service} instance GUID ${var.existing_kms_instance_guid}"
95-
}
96-
9763
##############################################################################
9864
# Context Based Restrictions
9965
##############################################################################

modules/fscloud/README.md

+8-5
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
# Financial Services Cloud Profile
1+
# Profile for IBM Cloud Framework for Financial Services
22

3-
This is a profile for Event Streams that meets Financial Services Cloud requirements.
4-
It has been scanned by [IBM Code Risk Analyzer (CRA)](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-plugin#terraform-command) and meets all applicable goals.
3+
This code is a version of the [parent root module](../../) that includes a default configuration that complies with the relevant controls from the [IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about). See the [Example for IBM Cloud Framework for Financial Services](/examples/fscloud/) for logic that uses this module. The profile assumes you are deploying into an account that complies with the framework.
4+
5+
The default values in this profile were scanned by [IBM Code Risk Analyzer (CRA)](https://cloud.ibm.com/docs/code-risk-analyzer-cli-plugin?topic=code-risk-analyzer-cli-plugin-cra-cli-plugin#terraform-command) for compliance with the IBM Cloud Framework for Financial Services profile that is specified by the IBM Security and Compliance Center. The scan passed for all applicable rules.
6+
7+
## Before you begin
8+
9+
Before you run the module, configure an authorization policy to allow the Event Streams service to access the key management service instance with the reader role. For more information, see [About KMS encryption](../../README.md#about-kms-encryption) in the main readme file.
510

611
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
712
### Requirements
@@ -27,11 +32,9 @@ No resources.
2732
|------|-------------|------|---------|:--------:|
2833
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | (Optional, list) List of CBR rules to create | <pre>list(object({<br> description = string<br> account_id = string<br> rule_contexts = list(object({<br> attributes = optional(list(object({<br> name = string<br> value = string<br> }))) }))<br> enforcement_mode = string<br> }))</pre> | `[]` | no |
2934
| <a name="input_es_name"></a> [es\_name](#input\_es\_name) | Name of the event streams instance | `string` | n/a | yes |
30-
| <a name="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of the Hyper Protect Crypto Services instance. | `string` | n/a | yes |
3135
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of the Hyper Protect Crypto Service (HPCS) to use for disk encryption. | `string` | n/a | yes |
3236
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | ID of resource group to use when creating the event stream instance | `string` | n/a | yes |
3337
| <a name="input_schemas"></a> [schemas](#input\_schemas) | The list of schema object which contains schema id and format of the schema | <pre>list(object(<br> {<br> schema_id = string<br> schema = object({<br> type = string<br> name = string<br> })<br> }<br> ))</pre> | `[]` | no |
34-
| <a name="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all event streams instances in the provided resource group reader access to the instance specified in the existing\_kms\_instance\_guid variable. | `bool` | `false` | no |
3538
| <a name="input_tags"></a> [tags](#input\_tags) | List of tags associated with the Event Steams instance | `list(string)` | `[]` | no |
3639
| <a name="input_topics"></a> [topics](#input\_topics) | List of topics. For lite plan only one topic is allowed. | <pre>list(object(<br> {<br> name = string<br> partitions = number<br> config = object({})<br> }<br> ))</pre> | `[]` | no |
3740

modules/fscloud/main.tf

+10-13
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,12 @@
11
module "event_streams" {
2-
source = "../../"
3-
resource_group_id = var.resource_group_id
4-
es_name = var.es_name
5-
plan = "enterprise-3nodes-2tb"
6-
kms_encryption_enabled = true
7-
skip_iam_authorization_policy = var.skip_iam_authorization_policy
8-
kms_key_crn = var.kms_key_crn
9-
existing_kms_instance_guid = var.existing_kms_instance_guid
10-
schemas = var.schemas
11-
tags = var.tags
12-
topics = var.topics
13-
service_endpoints = "private"
14-
cbr_rules = var.cbr_rules
2+
source = "../../"
3+
resource_group_id = var.resource_group_id
4+
es_name = var.es_name
5+
plan = "enterprise-3nodes-2tb"
6+
kms_key_crn = var.kms_key_crn
7+
schemas = var.schemas
8+
tags = var.tags
9+
topics = var.topics
10+
service_endpoints = "private"
11+
cbr_rules = var.cbr_rules
1512
}

0 commit comments

Comments
 (0)