You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+8-3Lines changed: 8 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,6 +15,8 @@
15
15
16
16
> WARNING: **This module does not support major version upgrade or updates to encryption and backup encryption keys**: To upgrade version create a new postgresql instance with the updated version and follow the [Upgrading PostgreSQL docs](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-upgrading&interface=cli)
17
17
18
+
> NOTE: The database encryption for backups supports only Key Protect keys, not the Hyper Protect Crypto Key at the moment. More info: https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs&interface=cli
19
+
18
20
```hcl
19
21
module "postgresql_db" {
20
22
# replace main with version
@@ -76,6 +78,7 @@ You need the following permissions to run this module.
@@ -85,10 +88,11 @@ You need the following permissions to run this module.
85
88
| <aname="input_allowlist"></a> [allowlist](#input\_allowlist)| Set of IP address and description to allowlist in database | <pre>list(object({<br> address = optional(string)<br> description = optional(string)<br> }))</pre> |`[]`| no |
| <aname="input_backup_crn"></a> [backup\_crn](#input\_backup\_crn)| The CRN of a backup resource to restore from. The backup is created by a database deployment with the same service ID. The backup is loaded after provisioning and the new deployment starts up that uses that data. A backup CRN is in the format crn:v1:<…>:backup:. If omitted, the database is provisioned empty. |`string`|`null`| no |
88
-
| <aname="input_backup_encryption_key_crn"></a> [backup\_encryption\_key\_crn](#input\_backup\_encryption\_key\_crn)| (Optional) The CRN of a key protect key, that you want to use for encrypting disk that holds deployment backups. If null, will use 'key\_protect\_key\_crn' as encryption key. If 'key\_protect\_key\_crn' is also null database is encrypted by using randomly generated keys. |`string`|`null`| no |
91
+
| <aname="input_backup_encryption_key_crn"></a> [backup\_encryption\_key\_crn](#input\_backup\_encryption\_key\_crn)| (Optional) The CRN of a Key Protect Key to use for encrypting backups. If left null, the value passed for the 'kms\_key\_crn' variable will be used. Take note that Hyper Protect Crypto Services for IBM Cloud® Databases backups is not currently supported. |`string`|`null`| no |
89
92
| <aname="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules)| (Optional, list) List of CBR rules to create | <pre>list(object({<br> description = string<br> account_id = string<br> rule_contexts = list(object({<br> attributes = optional(list(object({<br> name = string<br> value = string<br> }))) }))<br> enforcement_mode = string<br> }))</pre> |`[]`| no |
| <aname="input_key_protect_key_crn"></a> [key\_protect\_key\_crn](#input\_key\_protect\_key\_crn)| (Optional) The root key CRN of a Key Management Service like Key Protect or Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. If `null`, database is encrypted by using randomly generated keys. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok for current list of supported regions for BYOK |`string`|`null`| no |
94
+
| <aname="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid)| The GUID of the Hyper Protect or Key Protect instance in which the key specified in var.kms\_key\_crn is coming from. Only required if skip\_iam\_authorization\_policy is false |`string`|`null`| no |
95
+
| <aname="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn)| (Optional) The root key CRN of a Key Management Service like Key Protect or Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. If `null`, database is encrypted by using randomly generated keys. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok for current list of supported regions for BYOK |`string`|`null`| no |
92
96
| <aname="input_member_cpu_count"></a> [member\_cpu\_count](#input\_member\_cpu\_count)| CPU allocation required for postgresql database |`string`|`"3"`| no |
93
97
| <aname="input_member_disk_mb"></a> [member\_disk\_mb](#input\_member\_disk\_mb)| Disk allocation required for postgresql database |`string`|`"5120"`| no |
94
98
| <aname="input_member_memory_mb"></a> [member\_memory\_mb](#input\_member\_memory\_mb)| Memory allocation required for postgresql database |`string`|`"1024"`| no |
@@ -98,12 +102,13 @@ You need the following permissions to run this module.
98
102
| <aname="input_pitr_id"></a> [pitr\_id](#input\_pitr\_id)| (Optional) The ID of the postgresql instance that you want to recover back to. Here ID of the postgresql instance is expected to be up and in running state. |`string`|`null`| no |
99
103
| <aname="input_pitr_time"></a> [pitr\_time](#input\_pitr\_time)| (Optional) The timestamp in UTC format (%Y-%m-%dT%H:%M:%SZ) that you want to restore to. To retrieve the timestamp, run the command (ibmcloud cdb postgresql earliest-pitr-timestamp <deploymentnameorCRN>) |`string`|`null`| no |
100
104
| <aname="input_plan_validation"></a> [plan\_validation](#input\_plan\_validation)| Enable or disable validating the database parameters for postgres during the plan phase |`bool`|`true`| no |
101
-
| <aname="input_region"></a> [region](#input\_region)| The region postgresql is to be created on. The region must support BYOK if key\_protect\_key\_crn is used |`string`|`"us-south"`| no |
105
+
| <aname="input_region"></a> [region](#input\_region)| The region postgresql is to be created on. The region must support BYOK region if Key Protect Key is used or KYOK region if Hyper Protect Crypto Service (HPCS) is used.|`string`|`"us-south"`| no |
102
106
| <aname="input_remote_leader_crn"></a> [remote\_leader\_crn](#input\_remote\_leader\_crn)| The CRN of the leader database to make the replica(read-only) deployment. |`string`|`null`| no |
103
107
| <aname="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id)| The resource group ID where the postgresql will be created |`string`| n/a | yes |
104
108
| <aname="input_resource_tags"></a> [resource\_tags](#input\_resource\_tags)| Optional list of tags to be added to created resources |`list(string)`|`[]`| no |
105
109
| <aname="input_service_credential_names"></a> [service\_credential\_names](#input\_service\_credential\_names)| Map of name, role for service credentials that you want to create for the database |`map(string)`|`{}`| no |
106
110
| <aname="input_service_endpoints"></a> [service\_endpoints](#input\_service\_endpoints)| Sets the endpoint of the Postgresql instance, valid values are 'public', 'private', or 'public-and-private' |`string`|`"private"`| no |
111
+
| <aname="input_skip_iam_authorization_policy"></a> [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy)| Set to true to skip the creation of an IAM authorization policy that permits all PostgreSQL database instances in the given Resource group to read the encryption key from the Hyper Protect or Key Protect instance in `existing_kms_instance_guid`. |`bool`|`true`| no |
Copy file name to clipboardExpand all lines: examples/fscloud/variables.tf
+9-8Lines changed: 9 additions & 8 deletions
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ variable "region" {
13
13
variable"prefix" {
14
14
type=string
15
15
description="Prefix to append to all resources created by this example"
16
-
default="sm-test"
16
+
default="fs-cloud"
17
17
}
18
18
19
19
variable"resource_group" {
@@ -34,11 +34,12 @@ variable "pg_version" {
34
34
default=null
35
35
}
36
36
37
-
variable"allowlist" {
38
-
type=list(object({
39
-
address =optional(string)
40
-
description =optional(string)
41
-
}))
42
-
default=[]
43
-
description="Set of IP address and description to allowlist in database"
37
+
variable"existing_kms_instance_guid" {
38
+
description="The GUID of the Hyper Protect Crypto service in which the key specified in var.kms_key_crn is coming from"
39
+
type=string
40
+
}
41
+
42
+
variable"kms_key_crn" {
43
+
type=string
44
+
description="The root key CRN of a Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs&interface=ui for more information on integrating HPCS with PostgreSQL database."
# The backup encryption key crn doesn't support Hyper Protect Crypto Service (HPCS) at the moment. If 'backup_encryption_key_crn' is null, will use 'kms_key_crn' as encryption key if its Key Protect key otherwise it will use using randomly generated keys.
validate_hpcs_guid_input=var.skip_iam_authorization_policy==false&& var.existing_kms_instance_guid==null?tobool("A value must be passed for var.existing_kms_instance_guid when creating an instance, var.skip_iam_authorization_policy is false.") :true
21
+
}
22
+
23
+
# Create IAM Authorization Policies to allow postgresql to access kms for the encryption key
0 commit comments