Skip to content

Commit 80d3101

Browse files
maheshwarishikhaShikhaMahe
maheshwarishikha
and
ShikhaMahe
authored
feat: add fscloud profile and example
* feat: add fscloud profile and example * fix: remove cbr rule tags --------- Co-authored-by: shikha-mah <shikha.mah@in.ibm.com>
1 parent 3a034a7 commit 80d3101

File tree

19 files changed

+467
-40
lines changed

19 files changed

+467
-40
lines changed

‎.github/workflows/ci.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,6 @@ jobs:
1616
uses: terraform-ibm-modules/common-pipeline-assets/.github/workflows/common-terraform-module-ci.yml@v1.7.3
1717
secrets: inherit
1818
with:
19-
craTarget: "examples/complete"
19+
craTarget: "examples/fscloud"
2020
craGoalIgnoreFile: "cra-tf-validate-ignore-goals.json"
2121
craEnvironmentVariables: "TF_VAR_existing_at_instance_crn=crn:v1:bluemix:public:logdnaat:eu-de:a/abac0df06b644a9cabc6e44f55b3880e:b1ef3365-dfbf-4d8f-8ac8-75f4f84d6f4a::"

‎README.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ You need the following permissions to run this module.
3939
- [ Autoscale example](examples/autoscale)
4040
- [ Complete example with byok encryption, CBR rules and storing credentials in secrets manager](examples/complete)
4141
- [ Default example](examples/default)
42+
- [ Financial Services Cloud profile example](examples/fscloud)
4243
<!-- END EXAMPLES HOOK -->
4344
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
4445
## Requirements
@@ -67,7 +68,7 @@ You need the following permissions to run this module.
6768
| <a name="input_allowlist"></a> [allowlist](#input\_allowlist) | Set of IP address and description to allowlist in database | <pre>list(object({<br> address = optional(string)<br> description = optional(string)<br> }))</pre> | `[]` | no |
6869
| <a name="input_auto_scaling"></a> [auto\_scaling](#input\_auto\_scaling) | (Optional) Configure rules to allow your database to automatically increase its resources. Single block of autoscaling is allowed at once. | <pre>object({<br> cpu = object({<br> rate_increase_percent = optional(number)<br> rate_limit_count_per_member = optional(number)<br> rate_period_seconds = optional(number)<br> rate_units = optional(string)<br> })<br> disk = object({<br> capacity_enabled = optional(bool)<br> free_space_less_than_percent = optional(number)<br> io_above_percent = optional(number)<br> io_enabled = optional(bool)<br> io_over_period = optional(string)<br> rate_increase_percent = optional(number)<br> rate_limit_mb_per_member = optional(number)<br> rate_period_seconds = optional(number)<br> rate_units = optional(string)<br> })<br> memory = object({<br> io_above_percent = optional(number)<br> io_enabled = optional(bool)<br> io_over_period = optional(string)<br> rate_increase_percent = optional(number)<br> rate_limit_mb_per_member = optional(number)<br> rate_period_seconds = optional(number)<br> rate_units = optional(string)<br> })<br> })</pre> | <pre>{<br> "cpu": {},<br> "disk": {},<br> "memory": {}<br>}</pre> | no |
6970
| <a name="input_backup_encryption_key_crn"></a> [backup\_encryption\_key\_crn](#input\_backup\_encryption\_key\_crn) | (Optional) The CRN of a key protect key, that you want to use for encrypting disk that holds deployment backups. If null, will use 'key\_protect\_key\_crn' as encryption key. If 'key\_protect\_key\_crn' is also null database is encrypted by using randomly generated keys. | `string` | `null` | no |
70-
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | (Optional, list) List of CBR rules to create, if operations is not set it will default to api-type:data-plane | <pre>list(object({<br> description = string<br> account_id = string<br> rule_contexts = list(object({<br> attributes = optional(list(object({<br> name = string<br> value = string<br> }))) }))<br> enforcement_mode = string<br> tags = optional(list(object({<br> name = string<br> value = string<br> })))<br> operations = optional(list(object({<br> api_types = list(object({<br> api_type_id = string<br> }))<br> })))<br> }))</pre> | `[]` | no |
71+
| <a name="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules) | (Optional, list) List of CBR rules to create | <pre>list(object({<br> description = string<br> account_id = string<br> rule_contexts = list(object({<br> attributes = optional(list(object({<br> name = string<br> value = string<br> }))) }))<br> enforcement_mode = string<br> }))</pre> | `[]` | no |
7172
| <a name="input_configuration"></a> [configuration](#input\_configuration) | (Optional, Json String) Database Configuration in JSON format. | <pre>object({<br> max_connections = optional(number)<br> max_prepared_transactions = optional(number)<br> deadlock_timeout = optional(number)<br> effective_io_concurrency = optional(number)<br> max_replication_slots = optional(number)<br> max_wal_senders = optional(number)<br> shared_buffers = optional(number)<br> synchronous_commit = optional(string)<br> wal_level = optional(string)<br> archive_timeout = optional(number)<br> log_min_duration_statement = optional(number)<br> })</pre> | `null` | no |
7273
| <a name="input_key_protect_key_crn"></a> [key\_protect\_key\_crn](#input\_key\_protect\_key\_crn) | (Optional) The root key CRN of a Key Management Service like Key Protect or Hyper Protect Crypto Service (HPCS) that you want to use for disk encryption. If `null`, database is encrypted by using randomly generated keys. See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok for current list of supported regions for BYOK | `string` | `null` | no |
7374
| <a name="input_member_cpu_count"></a> [member\_cpu\_count](#input\_member\_cpu\_count) | CPU allocation required for postgresql database | `string` | `"3"` | no |
@@ -86,7 +87,8 @@ You need the following permissions to run this module.
8687

8788
| Name | Description |
8889
|------|-------------|
89-
| <a name="output_id"></a> [id](#output\_id) | Postgresl instance id |
90+
| <a name="output_guid"></a> [guid](#output\_guid) | Postgresql instance guid |
91+
| <a name="output_id"></a> [id](#output\_id) | Postgresql instance id |
9092
| <a name="output_version"></a> [version](#output\_version) | Postgresql instance version |
9193
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
9294
<!-- BEGIN CONTRIBUTING HOOK -->

‎examples/complete/main.tf

Lines changed: 1 addition & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -89,20 +89,9 @@ module "postgresql_db" {
8989
resource_tags = var.resource_tags
9090
cbr_rules = [
9191
{
92-
name = var.pg_version == null ? "${var.prefix}-postgres-zone" : "${var.prefix}-${var.pg_version}-postgres-zone"
93-
description = "sample rule"
92+
description = "${var.prefix}-postgres access only from vpc"
9493
enforcement_mode = "enabled" #Postgresql does not support report mode
9594
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
96-
tags = [
97-
{
98-
name = "environment"
99-
value = "${var.prefix}-test"
100-
},
101-
{
102-
name = "terraform-rule"
103-
value = "allow-${var.prefix}-vpc-to-${var.prefix}-postgresql"
104-
}
105-
]
10695
rule_contexts = [{
10796
attributes = [
10897
{

‎examples/fscloud/README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
# Financial Services Cloud profile example
2+
3+
## *Note:* This example is only deploying Postgresql in a compliant manner the other infrastructure is not necessarily compliant.
4+
5+
An example using the fscloud profile to deploy a compliant Postgresql instance. This example uses the IBM Cloud terraform provider to:
6+
7+
- Create a new resource group if one is not passed in.
8+
- Create a new ICD Postgresql database instance and credentials.
9+
- Create Key Protect instance with root key.
10+
- Backend encryption using generated Key Protect key.
11+
- Create a Sample VPC.
12+
- Create Context Based Restriction(CBR) to only allow Postgresql to be accessible from the VPC.

‎examples/fscloud/main.tf

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
##############################################################################
2+
# Resource Group
3+
##############################################################################
4+
5+
module "resource_group" {
6+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-resource-group.git?ref=v1.0.5"
7+
# if an existing resource group is not set (null) create a new one using prefix
8+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
9+
existing_resource_group_name = var.resource_group
10+
}
11+
12+
##############################################################################
13+
# Key Protect All Inclusive
14+
##############################################################################
15+
16+
module "key_protect_all_inclusive" {
17+
providers = {
18+
restapi = restapi.kp
19+
}
20+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-key-protect-all-inclusive.git?ref=v3.1.1"
21+
resource_group_id = module.resource_group.resource_group_id
22+
# Note: Database instance and Key Protect must be created in the same region when using BYOK
23+
# See https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok
24+
region = var.region
25+
key_protect_instance_name = "${var.prefix}-kp"
26+
resource_tags = var.resource_tags
27+
key_map = { "icd-pg" = ["${var.prefix}-pg"] }
28+
}
29+
30+
# Create IAM Access Policy to allow Key protect to access Postgres instance
31+
resource "ibm_iam_authorization_policy" "policy" {
32+
source_service_name = "databases-for-postgresql"
33+
source_resource_group_id = module.resource_group.resource_group_id
34+
target_service_name = "kms"
35+
target_resource_instance_id = module.key_protect_all_inclusive.key_protect_guid
36+
roles = ["Reader"]
37+
}
38+
39+
##############################################################################
40+
# Get Cloud Account ID
41+
##############################################################################
42+
43+
data "ibm_iam_account_settings" "iam_account_settings" {
44+
}
45+
46+
##############################################################################
47+
# VPC
48+
##############################################################################
49+
resource "ibm_is_vpc" "example_vpc" {
50+
name = "${var.prefix}-vpc"
51+
resource_group = module.resource_group.resource_group_id
52+
tags = var.resource_tags
53+
}
54+
55+
resource "ibm_is_subnet" "testacc_subnet" {
56+
name = "${var.prefix}-subnet"
57+
vpc = ibm_is_vpc.example_vpc.id
58+
zone = "${var.region}-1"
59+
total_ipv4_address_count = 256
60+
resource_group = module.resource_group.resource_group_id
61+
}
62+
63+
##############################################################################
64+
# Create CBR Zone
65+
##############################################################################
66+
module "cbr_zone" {
67+
source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-cbr//cbr-zone-module?ref=v1.1.2"
68+
name = "${var.prefix}-VPC-network-zone"
69+
zone_description = "CBR Network zone representing VPC"
70+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
71+
addresses = [{
72+
type = "vpc", # to bind a specific vpc to the zone
73+
value = ibm_is_vpc.example_vpc.crn,
74+
}]
75+
}
76+
77+
##############################################################################
78+
# Postgres Instance
79+
##############################################################################
80+
81+
module "postgresql_db" {
82+
source = "../../profiles/fscloud"
83+
resource_group_id = module.resource_group.resource_group_id
84+
name = "${var.prefix}-postgres"
85+
region = var.region
86+
pg_version = var.pg_version
87+
key_protect_key_crn = module.key_protect_all_inclusive.keys["icd-pg.${var.prefix}-pg"].crn
88+
resource_tags = var.resource_tags
89+
allowlist = var.allowlist
90+
cbr_rules = [
91+
{
92+
description = "${var.prefix}-postgres access only from vpc"
93+
enforcement_mode = "enabled" #Postgresql does not support report mode
94+
account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
95+
rule_contexts = [{
96+
attributes = [
97+
{
98+
"name" : "endpointType",
99+
"value" : "private"
100+
},
101+
{
102+
name = "networkZoneId"
103+
value = module.cbr_zone.zone_id
104+
}]
105+
}]
106+
}
107+
]
108+
}

‎examples/fscloud/outputs.tf

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
output "id" {
5+
description = "Postgresql instance id"
6+
value = module.postgresql_db.id
7+
}
8+
9+
output "guid" {
10+
description = "Postgresql instance guid"
11+
value = module.postgresql_db.guid
12+
}
13+
14+
output "version" {
15+
description = "Postgresql instance version"
16+
value = module.postgresql_db.version
17+
}

‎examples/fscloud/provider.tf

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}
5+
6+
# used by the restapi provider to authenticate the API call based on API key
7+
data "ibm_iam_auth_token" "token_data" {
8+
}
9+
10+
provider "restapi" {
11+
uri = "https:"
12+
alias = "kp"
13+
write_returns_object = false
14+
create_returns_object = false
15+
debug = false # set to true to show detailed logs, but use carefully as it might print sensitive values.
16+
headers = {
17+
Authorization = data.ibm_iam_auth_token.token_data.iam_access_token
18+
Bluemix-Instance = module.key_protect_all_inclusive.key_protect_guid
19+
Content-Type = "application/vnd.ibm.kms.policy+json"
20+
}
21+
}

‎examples/fscloud/variables.tf

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
variable "ibmcloud_api_key" {
2+
type = string
3+
description = "The IBM Cloud API Key"
4+
sensitive = true
5+
}
6+
7+
variable "region" {
8+
type = string
9+
description = "Region to provision all resources created by this example."
10+
default = "us-south"
11+
}
12+
13+
variable "prefix" {
14+
type = string
15+
description = "Prefix to append to all resources created by this example"
16+
default = "sm-test"
17+
}
18+
19+
variable "resource_group" {
20+
type = string
21+
description = "An existing resource group name to use for this example, if unset a new resource group will be created"
22+
default = null
23+
}
24+
25+
variable "resource_tags" {
26+
type = list(string)
27+
description = "Optional list of tags to be added to created resources"
28+
default = []
29+
}
30+
31+
variable "pg_version" {
32+
description = "Version of the postgresql instance"
33+
type = string
34+
default = null
35+
}
36+
37+
variable "allowlist" {
38+
type = list(object({
39+
address = optional(string)
40+
description = optional(string)
41+
}))
42+
default = []
43+
description = "Set of IP address and description to allowlist in database"
44+
}

‎examples/fscloud/version.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
terraform {
2+
required_version = ">= 1.3.0"
3+
required_providers {
4+
# Pin to the lowest provider version of the range defined in the main module's version.tf to ensure lowest version still works
5+
ibm = {
6+
source = "IBM-Cloud/ibm"
7+
version = "1.49.0"
8+
}
9+
restapi = {
10+
source = "Mastercard/restapi"
11+
version = ">=1.18.0"
12+
}
13+
}
14+
}

‎main.tf

Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -107,23 +107,17 @@ module "cbr_rule" {
107107
},
108108
{
109109
name = "serviceInstance"
110-
value = ibm_database.postgresql_db.id
110+
value = ibm_database.postgresql_db.guid
111111
operator = "stringEquals"
112112
},
113113
{
114114
name = "serviceName"
115115
value = "databases-for-postgresql"
116116
operator = "stringEquals"
117117
}
118-
],
119-
tags = var.cbr_rules[count.index].tags != null ? var.cbr_rules[count.index].tags : [
120-
{
121-
name = "terraform-rule"
122-
value = "allow-postgresql"
123-
}
124118
]
125119
}]
126-
operations = var.cbr_rules[count.index].operations != null ? var.cbr_rules[count.index].operations : [{
120+
operations = [{
127121
api_types = [
128122
{
129123
api_type_id = "crn:v1:bluemix:public:context-based-restrictions::::api-type:data-plane"

0 commit comments

Comments
 (0)