Skip to content

Commit 97051ca

Browse files
chrisw-ibmchrisw-ibm
authored
Feat: new input parameter overwrite_existing_reports. Defaults to overwriting existing billing report (#27)
* feat: Allow configuration of billing report overwriting to save on costs * Update iam role requirements
1 parent fa220d8 commit 97051ca

File tree

9 files changed

+93
-113
lines changed

9 files changed

+93
-113
lines changed

‎README.md‎

Lines changed: 12 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -75,9 +75,11 @@ You need the following permissions to run this module:
7575
- Account management services
7676
- **Billing** service
7777
- `Administrator` platform access
78-
- **Enterprise** service (only for enterprise accounts)
79-
- `Viewer` platform access
80-
- **IAM Access Management** service (only for enterprise accounts)
78+
- **Enterprise** service (only for enterprise accounts ie. `is_enterprise_account` is true)
79+
- `Administrator` platform access
80+
- **IAM Access Management** service
81+
- `Administrator` platform access
82+
- **All Account Management** service (only if `use_existing_resource_group` is true)
8183
- `Administrator` platform access
8284

8385
<!-- NO PERMISSIONS FOR MODULE
@@ -125,11 +127,11 @@ statement instead the previous block.
125127
| <a name="input_activity_tracker_read_data_events"></a> [activity\_tracker\_read\_data\_events](#input\_activity\_tracker\_read\_data\_events) | If set to true, all Object Storage bucket read events (i.e. downloads) will be sent to Activity Tracker. | `bool` | `true` | no |
126128
| <a name="input_activity_tracker_write_data_events"></a> [activity\_tracker\_write\_data\_events](#input\_activity\_tracker\_write\_data\_events) | If set to true, all Object Storage bucket write events (i.e. uploads) will be sent to Activity Tracker. | `bool` | `true` | no |
127129
| <a name="input_add_bucket_name_suffix"></a> [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Add random generated suffix (4 characters long) to the newly provisioned COS bucket name (Optional). | `bool` | `true` | no |
128-
| <a name="input_archive_days"></a> [archive\_days](#input\_archive\_days) | Specifies the number of days when the archive rule action takes effect. Only used if 'create\_cos\_bucket' is true. This must be set to null when when using var.cross\_region\_location as archive data is not supported with this feature. | `number` | `null` | no |
129-
| <a name="input_archive_type"></a> [archive\_type](#input\_archive\_type) | Specifies the storage class or archive type to which you want the object to transition. Only used if 'create\_cos\_bucket' is true. | `string` | `"Glacier"` | no |
130+
| <a name="input_archive_days"></a> [archive\_days](#input\_archive\_days) | Specifies the number of days when the archive rule action takes effect. This must be set to null when when using var.cross\_region\_location as archive data is not supported with this feature. | `number` | `null` | no |
131+
| <a name="input_archive_type"></a> [archive\_type](#input\_archive\_type) | Specifies the storage class or archive type to which you want the object to transition. | `string` | `"Glacier"` | no |
130132
| <a name="input_bucket_cbr_rules"></a> [bucket\_cbr\_rules](#input\_bucket\_cbr\_rules) | (Optional, list) List of CBR rules to create for the bucket | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
131-
| <a name="input_bucket_name"></a> [bucket\_name](#input\_bucket\_name) | The name to give the newly provisioned COS bucket. Only required if 'create\_cos\_bucket' is true. | `string` | `"apptio-cldy-billing-snapshots"` | no |
132-
| <a name="input_bucket_storage_class"></a> [bucket\_storage\_class](#input\_bucket\_storage\_class) | the storage class of the newly provisioned COS bucket. Only required if 'create\_cos\_bucket' is true. Supported values are 'standard', 'vault', 'cold', 'smart' and `onerate_active`. | `string` | `"standard"` | no |
133+
| <a name="input_bucket_name"></a> [bucket\_name](#input\_bucket\_name) | The name to give the newly provisioned COS bucket. | `string` | `"apptio-cldy-billing-snapshots"` | no |
134+
| <a name="input_bucket_storage_class"></a> [bucket\_storage\_class](#input\_bucket\_storage\_class) | the storage class of the newly provisioned COS bucket. Supported values are 'standard', 'vault', 'cold', 'smart' and `onerate_active`. | `string` | `"standard"` | no |
133135
| <a name="input_cloudability_api_key"></a> [cloudability\_api\_key](#input\_cloudability\_api\_key) | Cloudability API Key. Retrieve your Api Key from https://app.apptio.com/cloudability#/settings/preferences under the section **Cloudability API** select **Enable API** which will generate an api key. Setting this value to __NULL__ will skip adding the IBM Cloud account to Cloudability and only configure IBM Cloud so that the IBM Cloud Account can be added to Cloudability manually | `string` | `null` | no |
134136
| <a name="input_cloudability_custom_role_name"></a> [cloudability\_custom\_role\_name](#input\_cloudability\_custom\_role\_name) | name of the custom role created access granted to cloudability service id to read from the billing reports cos bucket | `string` | `"CloudabilityStorageCustomRole"` | no |
135137
| <a name="input_cloudability_enterprise_custom_role_name"></a> [cloudability\_enterprise\_custom\_role\_name](#input\_cloudability\_enterprise\_custom\_role\_name) | name of the custom role to granting access to a cloudability service id to read the enterprise information. Only used of var.is\_enterprise\_account is set. | `string` | `"CloudabilityListAccCustomRole"` | no |
@@ -145,7 +147,7 @@ statement instead the previous block.
145147
| <a name="input_enterprise_id"></a> [enterprise\_id](#input\_enterprise\_id) | Id of the enterprise. Can be automatically retrieved if `is_enterprise_account` is true | `string` | `null` | no |
146148
| <a name="input_existing_cos_instance_id"></a> [existing\_cos\_instance\_id](#input\_existing\_cos\_instance\_id) | The ID of an existing cloud object storage instance. Required if 'var.create\_cos\_instance' is false. | `string` | `null` | no |
147149
| <a name="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid) | The GUID of the Key Protect or Hyper Protect instance in which the key specified in var.kms\_key\_crn is coming from. Required if var.skip\_iam\_authorization\_policy is false in order to create an IAM Access Policy to allow Key Protect or Hyper Protect to access the newly created COS instance. | `string` | `null` | no |
148-
| <a name="input_expire_days"></a> [expire\_days](#input\_expire\_days) | Specifies the number of days when the expire rule action takes effect. Only used if 'create\_cos\_bucket' is true. | `number` | `null` | no |
150+
| <a name="input_expire_days"></a> [expire\_days](#input\_expire\_days) | Specifies the number of days when the expire rule action takes effect. | `number` | `null` | no |
149151
| <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key which will enable billing exports | `string` | n/a | yes |
150152
| <a name="input_instance_cbr_rules"></a> [instance\_cbr\_rules](#input\_instance\_cbr\_rules) | (Optional, list) List of CBR rules to create for the instance | <pre>list(object({<br/> description = string<br/> account_id = string<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> operations = optional(list(object({<br/> api_types = list(object({<br/> api_type_id = string<br/> }))<br/> })))<br/> }))</pre> | `[]` | no |
151153
| <a name="input_is_enterprise_account"></a> [is\_enterprise\_account](#input\_is\_enterprise\_account) | Whether billing exports are enabled for the enterprise account | `bool` | `false` | no |
@@ -154,17 +156,13 @@ statement instead the previous block.
154156
| <a name="input_key_ring_name"></a> [key\_ring\_name](#input\_key\_ring\_name) | Name of the key ring to group keys | `string` | `"bucket-encryption"` | no |
155157
| <a name="input_management_endpoint_type_for_bucket"></a> [management\_endpoint\_type\_for\_bucket](#input\_management\_endpoint\_type\_for\_bucket) | The type of endpoint for the IBM terraform provider to use to manage the bucket. (public, private or direct) | `string` | `"public"` | no |
156158
| <a name="input_monitoring_crn"></a> [monitoring\_crn](#input\_monitoring\_crn) | The CRN of an IBM Cloud Monitoring instance to to send Object Storage bucket metrics to. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. | `string` | `null` | no |
157-
| <a name="input_object_versioning_enabled"></a> [object\_versioning\_enabled](#input\_object\_versioning\_enabled) | Enable object versioning to keep multiple versions of an object in a bucket. Cannot be used with retention rule. Only used if 'create\_cos\_bucket' is true. | `bool` | `false` | no |
159+
| <a name="input_object_versioning_enabled"></a> [object\_versioning\_enabled](#input\_object\_versioning\_enabled) | Enable [object versioning](/docs/cloud-object-storage?topic=cloud-object-storage-versioning) to keep multiple versions of an object in a bucket. | `bool` | `false` | no |
160+
| <a name="input_overwrite_existing_reports"></a> [overwrite\_existing\_reports](#input\_overwrite\_existing\_reports) | A new version of report is created or the existing report version is overwritten with every update. | `bool` | `true` | no |
158161
| <a name="input_policy_granularity"></a> [policy\_granularity](#input\_policy\_granularity) | Whether access to the cos bucket is controlled at the bucket (resource), cos instance (serviceInstance), or resource-group (resourceGroup). | `string` | `"resource"` | no |
159162
| <a name="input_region"></a> [region](#input\_region) | Region where resources will be created | `string` | `"us-south"` | no |
160163
| <a name="input_request_metrics_enabled"></a> [request\_metrics\_enabled](#input\_request\_metrics\_enabled) | If set to `true`, all Object Storage bucket request metrics will be sent to the monitoring service. | `bool` | `true` | no |
161164
| <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of an existing resource group to provision resources in to. | `string` | `"Default"` | no |
162165
| <a name="input_resource_tags"></a> [resource\_tags](#input\_resource\_tags) | Optional list of tags to be added to created resources | `list(string)` | `[]` | no |
163-
| <a name="input_retention_default"></a> [retention\_default](#input\_retention\_default) | Specifies default duration of time an object that can be kept unmodified for COS bucket. Only used if 'create\_cos\_bucket' is true. | `number` | `90` | no |
164-
| <a name="input_retention_enabled"></a> [retention\_enabled](#input\_retention\_enabled) | Retention enabled for COS bucket. Only used if 'create\_cos\_bucket' is true. | `bool` | `false` | no |
165-
| <a name="input_retention_maximum"></a> [retention\_maximum](#input\_retention\_maximum) | Specifies maximum duration of time an object that can be kept unmodified for COS bucket. Only used if 'create\_cos\_bucket' is true. | `number` | `365` | no |
166-
| <a name="input_retention_minimum"></a> [retention\_minimum](#input\_retention\_minimum) | Specifies minimum duration of time an object must be kept unmodified for COS bucket. Only used if 'create\_cos\_bucket' is true. | `number` | `1` | no |
167-
| <a name="input_retention_permanent"></a> [retention\_permanent](#input\_retention\_permanent) | Specifies a permanent retention status either enable or disable for COS bucket. Only used if 'create\_cos\_bucket' is true. | `bool` | `false` | no |
168166
| <a name="input_skip_cloudability_billing_policy"></a> [skip\_cloudability\_billing\_policy](#input\_skip\_cloudability\_billing\_policy) | Whether policy which grants cloudability access to view the billing service. This may be true if the policy already exists because it was created by a previous run. | `bool` | `false` | no |
169167
| <a name="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the COS instance created to read the encryption key from the KMS instance in `existing_kms_instance_guid`. WARNING: An authorization policy must exist before an encrypted bucket can be created | `bool` | `false` | no |
170168
| <a name="input_skip_verification"></a> [skip\_verification](#input\_skip\_verification) | whether to verify the account after adding the account to cloudability. Requires cloudability\_auth\_header to be set. | `bool` | `false` | no |

‎ibm_catalog.json‎

Lines changed: 45 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,7 @@
44
"label": "IBM Cloudability Enablement",
55
"name": "deploy-arch-ibm-cloudability",
66
"product_kind": "solution",
7-
"tags": [
8-
"ibm_created",
9-
"integration"
10-
],
7+
"tags": ["ibm_created", "integration"],
118
"keywords": [
129
"Billing",
1310
"Apptio",
@@ -85,6 +82,12 @@
8582
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
8683
"crn:v1:bluemix:public:iam::::role:Editor"
8784
]
85+
},
86+
{
87+
"service_name": "account-management",
88+
"role_crns": [
89+
"crn:v1:bluemix:public:iam::::role:Administrator"
90+
]
8891
}
8992
],
9093
"architecture": {
@@ -95,7 +98,7 @@
9598
"type": "image/svg+xml",
9699
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-cloudability-onboarding/refs/heads/main/reference-architecture/cloudability-all-inclusive-onboarding.svg"
97100
},
98-
"description": "Billing exports are written to a Key Protect encrypted COS bucket. IBM Cloudability is granted access to read from this bucket to add ibm cloud billing reports daily. Key Protect and Cloud Object Storage are created in your desired region and resource group. Optionally, configure retention and archiving of the data in your bucket and enable monitoring and auditing to your cloud object storage bucket."
101+
"description": "Billing exports are written to a Key Protect encrypted COS bucket. IBM Cloudability is granted access to read from this bucket to add ibm cloud billing reports daily. Key Protect and Cloud Object Storage are created in your desired region and resource group. Optionally, configure archiving of the data in your bucket and enable monitoring and auditing to your cloud object storage bucket."
99102
}
100103
],
101104
"features": [
@@ -175,16 +178,16 @@
175178
"required": true,
176179
"options": [
177180
{
178-
"displayname": "Dallas (us-south) w/ kms failover",
179-
"value": "us-south"
181+
"displayname": "Dallas (us-south) w/ kms failover",
182+
"value": "us-south"
180183
},
181184
{
182-
"displayname": "Frankfurt (eu-de) w/ kms failover",
183-
"value": "eu-de"
185+
"displayname": "Frankfurt (eu-de) w/ kms failover",
186+
"value": "eu-de"
184187
},
185188
{
186-
"displayname": "Tokyo (jp-tok) w/ kms failover",
187-
"value": "jp-tok"
189+
"displayname": "Tokyo (jp-tok) w/ kms failover",
190+
"value": "jp-tok"
188191
},
189192
{
190193
"displayname": "Washington DC (us-east)",
@@ -385,7 +388,7 @@
385388
{
386389
"key": "bucket_storage_class",
387390
"type": "string",
388-
"default_value": "smart",
391+
"default_value": "standard",
389392
"description": "The storage class of the newly provisioned COS bucket of a `standard` or `lite` plan instance. Not required for one rate instances.",
390393
"required": true,
391394
"options": [
@@ -407,6 +410,23 @@
407410
}
408411
]
409412
},
413+
{
414+
"key": "overwrite_existing_reports",
415+
"type": "boolean",
416+
"default_value": "true",
417+
"description": "Whether each update overwrites the existing report version or a new version of report is created leaving the existing report.",
418+
"required": false,
419+
"options": [
420+
{
421+
"displayname": "Yes",
422+
"value": "true"
423+
},
424+
{
425+
"displayname": "No",
426+
"value": "false"
427+
}
428+
]
429+
},
410430
{
411431
"key": "object_versioning_enabled",
412432
"type": "boolean",
@@ -417,7 +437,7 @@
417437
{
418438
"key": "archive_days",
419439
"type": "number",
420-
"default_value": 62,
440+
"default_value": 7,
421441
"description": "Specifies the number of days when the archive rule action takes effect.",
422442
"required": false
423443
},
@@ -441,8 +461,8 @@
441461
{
442462
"key": "expire_days",
443463
"type": "number",
444-
"default_value": 180,
445-
"description": "Specifies the number of days when the expire rule action takes effect.",
464+
"default_value": 90,
465+
"description": "Specifies the number of days when the expire rule action takes effect. [Learn more](/docs/cloud-object-storage?topic=cloud-object-storage-expiry)",
446466
"required": false
447467
},
448468
{
@@ -453,8 +473,8 @@
453473
"hidden": true,
454474
"options": [
455475
{
456-
"displayname": "Bucket",
457-
"value": "resource"
476+
"displayname": "Bucket",
477+
"value": "resource"
458478
},
459479
{
460480
"displayname": "Instance",
@@ -464,7 +484,7 @@
464484
"displayname": "Resource Group",
465485
"value": "resourceGroup"
466486
}
467-
]
487+
]
468488
},
469489
{
470490
"key": "cloudability_custom_role_name",
@@ -489,28 +509,28 @@
489509
],
490510
"outputs": [
491511
{
492-
"key": "resource_group_id",
493-
"description": "Resource Group ID"
512+
"key": "resource_group_id",
513+
"description": "Resource Group ID"
494514
},
495515
{
496-
"key": "s3_endpoint_public",
497-
"description": "public endpoint to the cos bucket"
516+
"key": "s3_endpoint_public",
517+
"description": "public endpoint to the cos bucket"
498518
},
499519
{
500520
"key": "bucket_id",
501521
"description": "id of the cos bucket"
502522
},
503523
{
504524
"key": "bucket_crn",
505-
"description": "crn of the cos bucket"
525+
"description": "crn of the cos bucket"
506526
},
507527
{
508528
"key": "bucket_name",
509-
"description": "name of the cos bucket"
529+
"description": "name of the cos bucket"
510530
},
511531
{
512532
"key": "bucket_storage_class",
513-
"description": "storage class of the cos bucket"
533+
"description": "storage class of the cos bucket"
514534
},
515535
{
516536
"key": "kms_key_crn",

‎main.tf‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,11 +49,7 @@ module "cos_bucket" {
4949
add_bucket_name_suffix = var.add_bucket_name_suffix
5050
bucket_storage_class = local.bucket_storage_class
5151
management_endpoint_type_for_bucket = var.management_endpoint_type_for_bucket
52-
retention_enabled = var.retention_enabled
53-
retention_default = var.retention_default
54-
retention_maximum = var.retention_maximum
55-
retention_minimum = var.retention_minimum
56-
retention_permanent = var.retention_permanent
52+
retention_enabled = false
5753
object_versioning_enabled = var.object_versioning_enabled
5854
archive_days = var.archive_days
5955
archive_type = var.archive_type
@@ -97,6 +93,7 @@ module "billing_exports" {
9793
cos_bucket_location = var.region
9894
cos_folder = var.cos_folder
9995
resource_group_id = module.resource_group.resource_group_id
96+
versioning = var.overwrite_existing_reports ? "overwrite" : "new"
10097
}
10198

10299
module "cloudability_onboarding" {

0 commit comments

Comments
 (0)