generated from terraform-ibm-modules/terraform-ibm-module-template
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add secure-by-default cbr submodule (#267)
Co-authored-by: Akash Kumar <[email protected]> Co-authored-by: Akash Kumar <[email protected]> Co-authored-by: Aashiq-J <[email protected]>
- Loading branch information
4 people
authored
Jul 31, 2023
1 parent
4ec347e
commit 5ac15fc
Showing
17 changed files
with
866 additions
and
126 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Submodule common-dev-assets
updated
16 files
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| # Pre-wired CBR configuration for FS Cloud example | ||
|
|
||
| This example demonstrates how to use the [fscloud profile](../../profiles/fscloud/) module to lay out a complete "secure by default" coarse-grained CBR topology in a given account. | ||
|
|
||
| This examples is designed to show case some of the key customization options for the module. In addition to the pre-wired CBR rules documented at [fscloud profile](../../profiles/fscloud/), this examples show how to customize the module to: | ||
| 1. Open up network traffic flow from ICD mongodb, ICD Postgresql to the Key Protect private endpoints | ||
| 2. Open up network traffic flow from Schematics to Key Protect public endpoints | ||
| 3. Open up network traffic flow from a block of IPs to the Schematics public endpoint | ||
| 4. Open up network traffic flow from the VPC created in this example to ICD postgresql private endpoints | ||
|
|
||
| Context: this examples covers a "pseudo" real-world scenario where: | ||
| 1. ICD Mongodb, and Postgresql instances are encrypted using keys storage in Key Protect. | ||
| 2. Schematics is used to execute terraform that create Key Protect keys and key ring over its public endpoint | ||
| 3. Operators used machines with a set list of public IPs to interact with Schematics | ||
| 4. Applications are running the VPC and need access to PostgreSQL via the private endpoint - eg: a VPE. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,116 @@ | ||
| ############################################################################## | ||
| # Resource Group | ||
| ############################################################################## | ||
|
|
||
| module "resource_group" { | ||
| source = "terraform-ibm-modules/resource-group/ibm" | ||
| version = "1.0.5" | ||
| # if an existing resource group is not set (null) create a new one using prefix | ||
| resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null | ||
| existing_resource_group_name = var.resource_group | ||
| } | ||
|
|
||
| # ############################################################################## | ||
| # # Get Cloud Account ID | ||
| # ############################################################################## | ||
| data "ibm_iam_account_settings" "iam_account_settings" { | ||
| } | ||
|
|
||
| ############################################################################## | ||
| # VPC | ||
| ############################################################################## | ||
| resource "ibm_is_vpc" "example_vpc" { | ||
| name = "${var.prefix}-vpc" | ||
| resource_group = module.resource_group.resource_group_id | ||
| tags = var.resource_tags | ||
| } | ||
|
|
||
| resource "ibm_is_public_gateway" "testacc_gateway" { | ||
| name = "${var.prefix}-pgateway" | ||
| vpc = ibm_is_vpc.example_vpc.id | ||
| zone = "${var.region}-1" | ||
| resource_group = module.resource_group.resource_group_id | ||
| } | ||
|
|
||
| resource "ibm_is_subnet" "testacc_subnet" { | ||
| name = "${var.prefix}-subnet" | ||
| vpc = ibm_is_vpc.example_vpc.id | ||
| zone = "${var.region}-1" | ||
| public_gateway = ibm_is_public_gateway.testacc_gateway.id | ||
| total_ipv4_address_count = 256 | ||
| resource_group = module.resource_group.resource_group_id | ||
| } | ||
|
|
||
| ############################################################################## | ||
| # CBR zone & rule creation | ||
| ############################################################################## | ||
|
|
||
| module "cbr_account_level" { | ||
| source = "../../profiles/fscloud" | ||
| prefix = var.prefix | ||
| zone_vpc_crn_list = [ibm_is_vpc.example_vpc.crn] | ||
| allow_cos_to_kms = var.allow_cos_to_kms | ||
| allow_block_storage_to_kms = var.allow_block_storage_to_kms | ||
| allow_roks_to_kms = var.allow_roks_to_kms | ||
| allow_vpcs_to_container_registry = var.allow_vpcs_to_container_registry | ||
| allow_vpcs_to_cos = var.allow_vpcs_to_cos | ||
|
|
||
| ## Enable enforcement for key protect as an example | ||
| ## The other services not referenced here, are either report, or disabled (when not support report) | ||
| target_service_details = { | ||
| "kms" = { | ||
| "enforcement_mode" = "enabled" | ||
| } | ||
| } | ||
|
|
||
| # Demonstrates how additional context to the rules created by this module can be added. | ||
| # This example open up: | ||
| # 1. Flows from icd mongodb, postgresql to kms on private endpoint | ||
| # 2. Flow from schematics on public kms endpoint | ||
| # 3. Add a block of ips to schematics public endpoint | ||
| # 4. Flow from vpc(s) specified in input zone_vpc_crn_list to postgresql private endpoint | ||
| custom_rule_contexts_by_service = { | ||
| "kms" = [{ | ||
| endpointType = "private" | ||
| service_ref_names = ["databases-for-mongodb", "databases-for-postgresql"] | ||
| }, | ||
| { | ||
| endpointType = "public" | ||
| service_ref_names = ["schematics"] | ||
| } | ||
| ], | ||
| "schematics" = [{ | ||
| endpointType = "public" | ||
| zone_ids = [module.cbr_zone_operator_ips.zone_id] | ||
| }], | ||
| "databases-for-postgresql" = [{ | ||
| endpointType = "private" | ||
| ## Give access to the zone containing the VPC passed in zone_vpc_crn_list input | ||
| add_managed_vpc_zone = true | ||
| }] | ||
| } | ||
| } | ||
|
|
||
| ## Example of zone using ip addresses, and reference in one of the zone created by the cbr_account_level above. | ||
| ## A zone used to group operator machine ips. | ||
| module "cbr_zone_operator_ips" { | ||
| source = "../../cbr-zone-module" | ||
| name = "List of operator environment public IPs" | ||
| account_id = data.ibm_iam_account_settings.iam_account_settings.account_id | ||
| zone_description = "Zone grouping list of known public ips for operator machines" | ||
| addresses = [{ | ||
| type = "subnet" | ||
| value = "0.0.0.0/0" # All ip for this public example - this would be narrowed down typically to an enterprise ip block | ||
| }] | ||
| } | ||
|
|
||
| ## Examples of data lookup on objects (zone, rule) created by the fscoud profile module | ||
| ## Get rule targetting "event-notification" | ||
| data "ibm_cbr_rule" "event_notification_rule" { | ||
| rule_id = module.cbr_account_level.map_target_service_rule_ids["event-notifications"].rule_id | ||
| } | ||
|
|
||
| ## Get zone having "event-notification" as single source | ||
| data "ibm_cbr_zone" "event_notifications_zone" { | ||
| zone_id = module.cbr_account_level.map_service_ref_name_zoneid["event-notifications"].zone_id | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| ############################################################################## | ||
| # Outputs | ||
| ############################################################################## | ||
|
|
||
| output "account_id" { | ||
| value = data.ibm_iam_account_settings.iam_account_settings.account_id | ||
| description = "Account ID (used in tests)" | ||
| } | ||
|
|
||
| output "map_service_ref_name_zoneid" { | ||
| value = module.cbr_account_level.map_service_ref_name_zoneid | ||
| description = "Map of service reference and zone ids" | ||
| } | ||
|
|
||
| output "map_vpc_zoneid" { | ||
| value = module.cbr_account_level.map_vpc_zoneid | ||
| description = "Map of VPC and zone ids" | ||
| } | ||
|
|
||
| output "map_target_service_rule_ids" { | ||
| value = module.cbr_account_level.map_target_service_rule_ids | ||
| description = "Map of target service and rule ids" | ||
| } | ||
|
|
||
| output "example_event_notification_zone" { | ||
| value = data.ibm_cbr_rule.event_notification_rule | ||
| description = "Example of rule created by the module. Demonstrates data lookup." | ||
| } | ||
|
|
||
| output "example_event_notification_rule" { | ||
| value = data.ibm_cbr_zone.event_notifications_zone | ||
| description = "Example of zone created by the module. Demonstrates data lookup." | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| provider "ibm" { | ||
| ibmcloud_api_key = var.ibmcloud_api_key | ||
| region = var.region | ||
| } |
Oops, something went wrong.