generated from terraform-ibm-modules/terraform-ibm-module-template
-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Added FScloud submodule (#126)
- Loading branch information
Showing
20 changed files
with
528 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| # Financial Services Cloud profile example | ||
|
|
||
| An end-to-end example that uses the [Profile for IBM Cloud Framework for Financial Services](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/modules/fscloud) to deploy an instance of Event Notification. | ||
|
|
||
| The example uses the IBM Cloud Terraform provider to create the following infrastructure: | ||
|
|
||
| - A resource group, if one is not passed in. | ||
| - An IAM authorization between all Event Notification instances in the given resource group and the KMS instance that is passed in. | ||
| - An Event Notification instance that is encrypted with the KMS root key that is passed in. | ||
| - A sample virtual private cloud (VPC). | ||
| - A context-based restriction (CBR) rule to only allow Event Notification to be accessible from within the VPC. | ||
|
|
||
| :exclamation: **Important:** In this example, only the Event Notification instance complies with the IBM Cloud Framework for Financial Services. Other parts of the infrastructure do not necessarily comply. | ||
|
|
||
| ## Before you begin | ||
|
|
||
| - You need a KMS instance and root key available in the region that you want to deploy your Event Notification instance to. | ||
| - To ensure compliance with FSCloud standards, it is required to use HPCS only. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,94 @@ | ||
| ############################################################################## | ||
| # Resource group | ||
| ############################################################################## | ||
|
|
||
| module "resource_group" { | ||
| source = "terraform-ibm-modules/resource-group/ibm" | ||
| version = "1.1.4" | ||
| # if an existing resource group is not set (null) create a new one using prefix | ||
| resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null | ||
| existing_resource_group_name = var.resource_group | ||
| } | ||
|
|
||
| ############################################################################## | ||
| # Get Cloud Account ID | ||
| ############################################################################## | ||
|
|
||
| data "ibm_iam_account_settings" "iam_account_settings" { | ||
| } | ||
|
|
||
| ############################################################################## | ||
| # VPC | ||
| ############################################################################## | ||
| resource "ibm_is_vpc" "example_vpc" { | ||
| name = "${var.prefix}-vpc" | ||
| resource_group = module.resource_group.resource_group_id | ||
| tags = var.resource_tags | ||
| } | ||
|
|
||
| resource "ibm_is_subnet" "testacc_subnet" { | ||
| name = "${var.prefix}-subnet" | ||
| vpc = ibm_is_vpc.example_vpc.id | ||
| zone = "${var.region}-1" | ||
| total_ipv4_address_count = 256 | ||
| resource_group = module.resource_group.resource_group_id | ||
| } | ||
|
|
||
| ############################################################################## | ||
| # Create CBR Zone | ||
| ############################################################################## | ||
|
|
||
| module "cbr_zone" { | ||
| source = "terraform-ibm-modules/cbr/ibm//modules/cbr-zone-module" | ||
| version = "1.17.1" | ||
| name = "${var.prefix}-VPC-network-zone" | ||
| zone_description = "CBR Network zone representing VPC" | ||
| account_id = data.ibm_iam_account_settings.iam_account_settings.account_id | ||
| addresses = [{ | ||
| type = "vpc", | ||
| value = ibm_is_vpc.example_vpc.crn | ||
| }] | ||
| } | ||
|
|
||
| module "event_notification" { | ||
| source = "../../modules/fscloud" | ||
| resource_group_id = module.resource_group.resource_group_id | ||
| name = "${var.prefix}-en-fs" | ||
| existing_kms_instance_crn = var.existing_kms_instance_crn | ||
| root_key_id = var.root_key_id | ||
| kms_endpoint_url = var.kms_endpoint_url | ||
| tags = var.resource_tags | ||
|
|
||
| # Map of name, role for service credentials that you want to create for the event notification | ||
| service_credential_names = { | ||
| "en_manager" : "Manager", | ||
| "en_writer" : "Writer", | ||
| "en_reader" : "Reader", | ||
| "en_channel_editor" : "Channel Editor", | ||
| "en_device_manager" : "Device Manager", | ||
| "en_event_source_manager" : "Event Source Manager", | ||
| "en_event_notifications_publisher" : "Event Notification Publisher", | ||
| "en_status_reporter" : "Status Reporter", | ||
| "en_email_sender" : "Email Sender", | ||
| "en_custom_email_status_reporter" : "Custom Email Status Reporter", | ||
| } | ||
| region = var.region | ||
| cbr_rules = [ | ||
| { | ||
| description = "${var.prefix}-event notification access only from vpc" | ||
| enforcement_mode = "report" | ||
| account_id = data.ibm_iam_account_settings.iam_account_settings.account_id | ||
| rule_contexts = [{ | ||
| attributes = [ | ||
| { | ||
| "name" : "endpointType", | ||
| "value" : "private" | ||
| }, | ||
| { | ||
| name = "networkZoneId" | ||
| value = module.cbr_zone.zone_id | ||
| }] | ||
| }] | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| ############################################################################## | ||
| # Outputs | ||
| ############################################################################## | ||
|
|
||
| output "resource_group_name" { | ||
| description = "Resource group name" | ||
| value = module.resource_group.resource_group_name | ||
| } | ||
|
|
||
| output "resource_group_id" { | ||
| description = "Resource group ID" | ||
| value = module.resource_group.resource_group_id | ||
| } | ||
|
|
||
| output "event_notification_instance_name" { | ||
| description = "Event Notification name" | ||
| value = module.event_notification.event_notification_instance_name | ||
| } | ||
|
|
||
| output "crn" { | ||
| description = "Event notification instance crn" | ||
| value = module.event_notification.crn | ||
| } | ||
|
|
||
| output "guid" { | ||
| description = "Event Notification guid" | ||
| value = module.event_notification.guid | ||
| } | ||
|
|
||
| output "service_credentials_json" { | ||
| description = "Service credentials json map" | ||
| value = module.event_notification.service_credentials_json | ||
| sensitive = true | ||
| } | ||
|
|
||
| output "service_credentials_object" { | ||
| description = "Service credentials json object" | ||
| value = module.event_notification.service_credentials_object | ||
| sensitive = true | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| ############################################################################## | ||
| # Provider config | ||
| ############################################################################## | ||
|
|
||
| provider "ibm" { | ||
| ibmcloud_api_key = var.ibmcloud_api_key | ||
| region = var.region | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| ############################################################################## | ||
| # Input Variables | ||
| ############################################################################## | ||
|
|
||
| variable "ibmcloud_api_key" { | ||
| type = string | ||
| description = "The IBM Cloud API Key" | ||
| sensitive = true | ||
| } | ||
|
|
||
| variable "resource_group" { | ||
| type = string | ||
| description = "The name of an existing resource group to provision resources in to. If not set a new resource group will be created using the prefix variable" | ||
| default = null | ||
| } | ||
|
|
||
| variable "prefix" { | ||
| type = string | ||
| description = "Prefix to append to all resources created by this example" | ||
| } | ||
|
|
||
| variable "resource_tags" { | ||
| type = list(string) | ||
| description = "Optional list of tags to be added to created resources" | ||
| default = [] | ||
| } | ||
|
|
||
| variable "region" { | ||
| type = string | ||
| description = "Region to provision all resources created by this example, Event Notifications supported regions are: us-south (Dallas), eu-gb (London), eu-de (Frankfurt), au-syd (Sydney), eu-es (Madrid)" | ||
| default = "us-south" | ||
| } | ||
|
|
||
| variable "existing_kms_instance_crn" { | ||
| description = "The CRN of the Hyper Protect Crypto Services. To ensure compliance with FSCloud standards, it is required to use HPCS only" | ||
| type = string | ||
| } | ||
|
|
||
| variable "root_key_id" { | ||
| type = string | ||
| description = "The Key ID of a root key, existing in the KMS instance passed in var.existing_kms_instance_crn, which will be used to encrypt the data encryption keys (DEKs) which are then used to encrypt the data." | ||
| } | ||
|
|
||
| variable "kms_endpoint_url" { | ||
| description = "The KMS endpoint URL to use when configuring KMS encryption." | ||
| type = string | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| terraform { | ||
| required_version = ">= 1.3.0, <1.6.0" | ||
|
|
||
| # Ensure that there is always 1 example locked into the lowest provider version of the range defined in the main | ||
| # module's version.tf (usually a basic example), and 1 example that will always use the latest provider version. | ||
| required_providers { | ||
| ibm = { | ||
| source = "IBM-Cloud/ibm" | ||
| version = ">= 1.56.1, < 2.0.0" | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.