feat: A fix was added to the instances variation to fix a breaking …

…change that occurred on the SCC service backend related to Event Notification integration. It is now required to pass a value for `en_source_name` when passing a value for `existing_en_crn`. Optionally you can now also pass a value for `en_source_description`.<br>* The `cluster_name` input in the `agents` variation has been replaced by `cluster_id` and `cluster_resource_group_id`. (#233)

ibm_catalog.json

@@ -226,6 +226,12 @@
             {
               "key": "existing_en_crn"
             },
+            {
+              "key": "en_source_name"
+            },
+            {
+              "key": "en_source_description"
+            },
             {
               "key": "scc_instance_tags"
             },
@@ -377,51 +383,40 @@
               "key": "namespace"
             },
             {
-              "key": "cluster_name"
+              "key": "cluster_id",
+              "custom_config": {
+                  "type": "cluster_var",
+                  "grouping": "deployment",
+                  "original_grouping": "deployment"
+              }
+            },
+            {
+              "key": "cluster_resource_group_id",
+              "custom_config": {
+                  "type": "resource_group",
+                  "grouping": "deployment",
+                  "original_grouping": "deployment",
+                  "config_constraints": {
+                      "identifier": "rg_id"
+                  }
+              }
             },
             {
               "key": "access_key"
             },
             {
               "key": "region",
-              "options": [
-                {
-                  "displayname": "Dallas (us-south)",
-                  "value": "us-south"
-                },
-                {
-                  "displayname": "Frankfurt (eu-de)",
-                  "value": "eu-de"
-                },
-                {
-                  "displayname": "London (eu-gb)",
-                  "value": "eu-gb"
-                },
-                {
-                  "displayname": "Osaka (jp-osa)",
-                  "value": "jp-osa"
-                },
-                {
-                  "displayname": "Sao Paulo (br-sao)",
-                  "value": "br-sao"
-                },
-                {
-                  "displayname": "Sydney (au-syd)",
-                  "value": "au-syd"
-                },
-                {
-                  "displayname": "Tokyo (jp-tok)",
-                  "value": "jp-tok"
-                },
-                {
-                  "displayname": "Toronto (ca-tor)",
-                  "value": "ca-tor"
-                },
-                {
-                  "displayname": "Washington (us-east)",
-                  "value": "us-east"
-                }
-              ]
+              "type": "string",
+              "custom_config": {
+                  "type": "region",
+                  "grouping": "deployment",
+                  "original_grouping": "deployment",
+                  "config_constraints": {
+                      "showKinds": [
+                          "region"
+                      ]
+                  }
+              }
             },
             {
               "key": "endpoint_type",

solutions/agents/main.tf

@@ -6,7 +6,7 @@ module "scc_wp_agent" {
   source                 = "terraform-ibm-modules/scc-workload-protection-agent/ibm"
   version                = "1.3.17"
   access_key             = var.access_key
-  cluster_name           = var.cluster_name
+  cluster_name           = var.is_vpc_cluster ? data.ibm_container_vpc_cluster.cluster[0].name : data.ibm_container_cluster.cluster[0].name
   region                 = var.region
   endpoint_type          = var.endpoint_type
   name                   = var.name
@@ -41,6 +41,4 @@ module "scc_wp_agent" {
   cluster_scanner_imagesbomextractor_requests_memory      = var.cluster_scanner_imagesbomextractor_requests_memory
   cluster_scanner_imagesbomextractor_limits_cpu           = var.cluster_scanner_imagesbomextractor_limits_cpu
   cluster_scanner_imagesbomextractor_limits_memory        = var.cluster_scanner_imagesbomextractor_limits_memory
-
-
 }

solutions/agents/provider.tf

@@ -8,8 +8,9 @@ provider "ibm" {
 }
 
 provider "kubernetes" {
-  host  = data.ibm_container_cluster_config.cluster_config.host
-  token = data.ibm_container_cluster_config.cluster_config.token
+  host                   = data.ibm_container_cluster_config.cluster_config.host
+  token                  = data.ibm_container_cluster_config.cluster_config.token
+  cluster_ca_certificate = data.ibm_container_cluster_config.cluster_config.ca_certificate
 }
 
 provider "helm" {
@@ -22,20 +23,21 @@ provider "helm" {
 
 data "ibm_container_vpc_cluster" "cluster" {
   count             = var.is_vpc_cluster ? 1 : 0
-  name              = var.cluster_name
+  name              = var.cluster_id
   wait_till         = var.wait_till
   wait_till_timeout = var.wait_till_timeout
 }
 
 data "ibm_container_cluster" "cluster" {
   count             = var.is_vpc_cluster ? 0 : 1
-  name              = var.cluster_name
+  name              = var.cluster_id
   wait_till         = var.wait_till
   wait_till_timeout = var.wait_till_timeout
 }
 
 data "ibm_container_cluster_config" "cluster_config" {
-  cluster_name_id = var.is_vpc_cluster ? data.ibm_container_vpc_cluster.cluster[0].name : data.ibm_container_cluster.cluster[0].name
-  config_dir      = "${path.module}/kubeconfig"
-  endpoint_type   = var.cluster_endpoint_type
+  cluster_name_id   = var.is_vpc_cluster ? data.ibm_container_vpc_cluster.cluster[0].id : data.ibm_container_cluster.cluster[0].id
+  config_dir        = "${path.module}/kubeconfig"
+  endpoint_type     = var.cluster_endpoint_type
+  resource_group_id = var.cluster_resource_group_id
 }

solutions/agents/variables.tf

@@ -24,9 +24,14 @@ variable "namespace" {
   default     = "ibm-scc-wp"
 }
 
-variable "cluster_name" {
+variable "cluster_id" {
   type        = string
-  description = "The cluster name to add the Workload Protection agent to."
+  description = "The cluster ID to add the Workload Protection agent to."
+}
+
+variable "cluster_resource_group_id" {
+  type        = string
+  description = "The resource group ID of the cluster."
 }
 
 variable "access_key" {

solutions/agents/version.tf

@@ -5,7 +5,7 @@ terraform {
     # Lock DA into an exact provider version - renovate automation will keep it updated
     ibm = {
       source  = "ibm-cloud/ibm"
-      version = "1.71.2"
+      version = "1.71.3"
     }
     helm = {
       source  = "hashicorp/helm"

solutions/instances/README.md

@@ -18,7 +18,7 @@ This solution supports provisioning and configuring the following infrastructure
 | Name | Version |
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
-| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.71.2 |
+| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | 1.71.3 |
 | <a name="requirement_time"></a> [time](#requirement\_time) | 0.12.1 |
 
 ### Modules
@@ -27,29 +27,29 @@ This solution supports provisioning and configuring the following infrastructure
 |------|--------|---------|
 | <a name="module_buckets"></a> [buckets](#module\_buckets) | terraform-ibm-modules/cos/ibm//modules/buckets | 8.15.1 |
 | <a name="module_cos"></a> [cos](#module\_cos) | terraform-ibm-modules/cos/ibm//modules/fscloud | 8.15.1 |
-| <a name="module_create_profile_attachment"></a> [create\_profile\_attachment](#module\_create\_profile\_attachment) | terraform-ibm-modules/scc/ibm//modules/attachment | 1.8.21 |
+| <a name="module_create_profile_attachment"></a> [create\_profile\_attachment](#module\_create\_profile\_attachment) | terraform-ibm-modules/scc/ibm//modules/attachment | 1.8.22 |
 | <a name="module_existing_cos_crn_parser"></a> [existing\_cos\_crn\_parser](#module\_existing\_cos\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_existing_en_crn_parser"></a> [existing\_en\_crn\_parser](#module\_existing\_en\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_existing_kms_crn_parser"></a> [existing\_kms\_crn\_parser](#module\_existing\_kms\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_existing_kms_key_crn_parser"></a> [existing\_kms\_key\_crn\_parser](#module\_existing\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_existing_scc_crn_parser"></a> [existing\_scc\_crn\_parser](#module\_existing\_scc\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.1.0 |
 | <a name="module_kms"></a> [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 4.16.11 |
 | <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.1.6 |
-| <a name="module_scc"></a> [scc](#module\_scc) | terraform-ibm-modules/scc/ibm | 1.8.21 |
+| <a name="module_scc"></a> [scc](#module\_scc) | terraform-ibm-modules/scc/ibm | 1.8.22 |
 | <a name="module_scc_wp"></a> [scc\_wp](#module\_scc\_wp) | terraform-ibm-modules/scc-workload-protection/ibm | 1.4.2 |
 
 ### Resources
 
 | Name | Type |
 |------|------|
-| [ibm_en_subscription_email.email_subscription](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.2/docs/resources/en_subscription_email) | resource |
-| [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.2/docs/resources/en_topic) | resource |
-| [ibm_iam_authorization_policy.cos_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.2/docs/resources/iam_authorization_policy) | resource |
+| [ibm_en_subscription_email.email_subscription](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.3/docs/resources/en_subscription_email) | resource |
+| [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.3/docs/resources/en_topic) | resource |
+| [ibm_iam_authorization_policy.cos_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.3/docs/resources/iam_authorization_policy) | resource |
 | [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.12.1/docs/resources/sleep) | resource |
 | [time_sleep.wait_for_scc](https://registry.terraform.io/providers/hashicorp/time/0.12.1/docs/resources/sleep) | resource |
-| [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.2/docs/data-sources/en_destinations) | data source |
-| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.2/docs/data-sources/iam_account_settings) | data source |
-| [ibm_resource_group.group](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.2/docs/data-sources/resource_group) | data source |
+| [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.3/docs/data-sources/en_destinations) | data source |
+| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.3/docs/data-sources/iam_account_settings) | data source |
+| [ibm_resource_group.group](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.71.3/docs/data-sources/resource_group) | data source |
 
 ### Inputs
 
@@ -61,6 +61,8 @@ This solution supports provisioning and configuring the following infrastructure
 | <a name="input_cos_instance_name"></a> [cos\_instance\_name](#input\_cos\_instance\_name) | The name for the Object Storage instance. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-cos"` | no |
 | <a name="input_cos_instance_tags"></a> [cos\_instance\_tags](#input\_cos\_instance\_tags) | The list of tags to add to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no |
 | <a name="input_cos_region"></a> [cos\_region](#input\_cos\_region) | The region for the Object Storage instance. | `string` | `"us-south"` | no |
+| <a name="input_en_source_description"></a> [en\_source\_description](#input\_en\_source\_description) | Optional description to give for the Event Notifications integration source. Only used if a value is passed for `en_instance_crn`. | `string` | `null` | no |
+| <a name="input_en_source_name"></a> [en\_source\_name](#input\_en\_source\_name) | The source name to use for the Event Notifications integration. Required if a value is passed for `en_instance_crn`. | `string` | `null` | no |
 | <a name="input_existing_activity_tracker_crn"></a> [existing\_activity\_tracker\_crn](#input\_existing\_activity\_tracker\_crn) | The CRN of an Activity Tracker instance to send Security and Compliance Object Storage bucket events to. If no value passed, events are sent to the instance associated to the container's location unless otherwise specified in the Activity Tracker Event Routing service configuration. Ignored if using existing Object Storage bucket. | `string` | `null` | no |
 | <a name="input_existing_cos_instance_crn"></a> [existing\_cos\_instance\_crn](#input\_existing\_cos\_instance\_crn) | The CRN of an existing Object Storage instance. If not specified, an instance is created. | `string` | `null` | no |
 | <a name="input_existing_en_crn"></a> [existing\_en\_crn](#input\_existing\_en\_crn) | The CRN of an Event Notification instance. Used to integrate with Security and Compliance Center. | `string` | `null` | no |

solutions/instances/main.tf

@@ -9,6 +9,8 @@ locals {
   validate_cos_inputs = var.existing_scc_cos_bucket_name != null && var.existing_scc_cos_kms_key_crn != null ? tobool("A value should not be passed for 'existing_scc_cos_kms_key_crn' when passing a value for 'existing_scc_cos_bucket_name'. A key is only needed when creating a new COS bucket.") : true
   # tflint-ignore: terraform_unused_declarations
   validate_auth_inputs = !var.skip_scc_cos_auth_policy && var.existing_cos_instance_crn == null && var.existing_scc_cos_bucket_name != null ? tobool("A value must be passed for 'existing_cos_instance_crn' in order to create auth policy.") : true
+  # tflint-ignore: terraform_unused_declarations
+  validate_en_integration = var.existing_en_crn != null && var.en_source_name == null ? tobool("When passing a value for 'existing_en_crn', a value must also be passed for 'en_source_name'.") : false
 }
 
 #######################################################################################################################
@@ -232,14 +234,16 @@ moved {
 module "scc" {
   source                            = "terraform-ibm-modules/scc/ibm"
   existing_scc_instance_crn         = var.existing_scc_instance_crn
-  version                           = "1.8.21"
+  version                           = "1.8.22"
   resource_group_id                 = module.resource_group.resource_group_id
   region                            = local.scc_instance_region
   instance_name                     = local.scc_instance_name
   plan                              = var.scc_service_plan
   cos_bucket                        = local.cos_bucket_name
   cos_instance_crn                  = local.cos_instance_crn
   en_instance_crn                   = var.existing_en_crn
+  en_source_name                    = var.en_source_name
+  en_source_description             = var.en_source_description
   skip_cos_iam_authorization_policy = var.skip_scc_cos_auth_policy
   resource_tags                     = var.scc_instance_tags
   attach_wp_to_scc_instance         = var.provision_scc_workload_protection && var.existing_scc_instance_crn == null
@@ -297,7 +301,7 @@ data "ibm_iam_account_settings" "iam_account_settings" {}
 
 module "create_profile_attachment" {
   source  = "terraform-ibm-modules/scc/ibm//modules/attachment"
-  version = "1.8.21"
+  version = "1.8.22"
   for_each = {
     for idx, profile_attachment in var.profile_attachments :
     profile_attachment => idx

solutions/instances/variables.tf

@@ -215,6 +215,18 @@ variable "existing_en_crn" {
   description = "The CRN of an Event Notification instance. Used to integrate with Security and Compliance Center."
 }
 
+variable "en_source_name" {
+  type        = string
+  default     = null
+  description = "The source name to use for the Event Notifications integration. Required if a value is passed for `en_instance_crn`."
+}
+
+variable "en_source_description" {
+  type        = string
+  default     = null
+  description = "Optional description to give for the Event Notifications integration source. Only used if a value is passed for `en_instance_crn`."
+}
+
 variable "scc_instance_tags" {
   type        = list(string)
   description = "The list of tags to add to the Security and Compliance Center instance."

solutions/instances/version.tf

@@ -4,7 +4,7 @@ terraform {
   required_providers {
     ibm = {
       source  = "IBM-Cloud/ibm"
-      version = "1.71.2"
+      version = "1.71.3"
     }
     time = {
       source  = "hashicorp/time"

tests/go.mod

@@ -1,13 +1,13 @@
 module github.com/terraform-ibm-modules/terraform-ibm-scc-da
 
-go 1.22.0
+go 1.22.4
 
 toolchain go1.23.3
 
 require (
 	github.com/gruntwork-io/terratest v0.47.2
-	github.com/stretchr/testify v1.9.0
-	github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.41.4
+	github.com/stretchr/testify v1.10.0
+	github.com/terraform-ibm-modules/ibmcloud-terratest-wrapper v1.42.2
 )
 
 require (
@@ -19,11 +19,11 @@ require (
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/IBM-Cloud/bluemix-go v0.0.0-20240719075425-078fcb3a55be // indirect
 	github.com/IBM-Cloud/power-go-client v1.8.3 // indirect
-	github.com/IBM/cloud-databases-go-sdk v0.7.0 // indirect
+	github.com/IBM/cloud-databases-go-sdk v0.7.1 // indirect
 	github.com/IBM/go-sdk-core/v5 v5.18.1 // indirect
-	github.com/IBM/platform-services-go-sdk v0.71.0 // indirect
+	github.com/IBM/platform-services-go-sdk v0.71.1 // indirect
 	github.com/IBM/project-go-sdk v0.3.6 // indirect
-	github.com/IBM/schematics-go-sdk v0.3.0 // indirect
+	github.com/IBM/schematics-go-sdk v0.4.0 // indirect
 	github.com/IBM/vpc-go-sdk v1.0.2 // indirect
 	github.com/Microsoft/go-winio v0.6.1 // indirect
 	github.com/ProtonMail/go-crypto v1.0.0 // indirect
@@ -103,7 +103,7 @@ require (
 	go.opentelemetry.io/otel/trace v1.16.0 // indirect
 	golang.org/x/crypto v0.29.0 // indirect
 	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/net v0.30.0 // indirect
 	golang.org/x/oauth2 v0.10.0 // indirect
 	golang.org/x/sync v0.9.0 // indirect
 	golang.org/x/sys v0.27.0 // indirect