diff --git a/README.md b/README.md
index c1f69b0..ac62e51 100644
--- a/README.md
+++ b/README.md
@@ -83,6 +83,8 @@ You need the following permissions to run this module.
| Name | Type |
|------|------|
| [ibm_iam_authorization_policy.en_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
+| [ibm_iam_authorization_policy.iam_groups_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
+| [ibm_iam_authorization_policy.iam_identity_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
| [ibm_iam_authorization_policy.kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
| [ibm_resource_instance.secrets_manager_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_instance) | resource |
| [ibm_sm_en_registration.sm_en_registration](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/sm_en_registration) | resource |
@@ -107,6 +109,7 @@ You need the following permissions to run this module.
| [secrets](#input\_secrets) | Secret Manager secrets configurations. | list(object({
secret_group_name = string
secret_group_description = optional(string)
existing_secret_group = optional(bool, false)
secrets = optional(list(object({
secret_name = string
secret_description = optional(string)
secret_type = optional(string)
imported_cert_certificate = optional(string)
imported_cert_private_key = optional(string)
imported_cert_intermediate = optional(string)
secret_username = optional(string)
secret_labels = optional(list(string), [])
secret_payload_password = optional(string, "")
secret_auto_rotation = optional(bool, true)
secret_auto_rotation_unit = optional(string, "day")
secret_auto_rotation_interval = optional(number, 89)
service_credentials_ttl = optional(string, "7776000") # 90 days
service_credentials_source_service_crn = optional(string)
service_credentials_source_service_role = optional(string)
})))
})) | `[]` | no |
| [secrets\_manager\_name](#input\_secrets\_manager\_name) | The name of the Secrets Manager instance to create | `string` | n/a | yes |
| [skip\_en\_iam\_authorization\_policy](#input\_skip\_en\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances (scoped to the resource group) an 'Event Source Manager' role to the given Event Notifications instance passed in the `existing_en_instance_crn` input variable. In addition, no policy is created if `enable_event_notification` is set to false. | `bool` | `false` | no |
+| [skip\_iam\_authorization\_policy](#input\_skip\_iam\_authorization\_policy) | Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine. If set to false, a policies will be created that grants the Secrets Manager instance Operator access to the IAM identity service, and Groups Service Member Manage access to the IAM groups service. | `bool` | `false` | no |
| [skip\_kms\_iam\_authorization\_policy](#input\_skip\_kms\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_guid` variable. In addition, no policy is created if `kms_encryption_enabled` is set to false. | `bool` | `false` | no |
| [sm\_service\_plan](#input\_sm\_service\_plan) | The Secrets Manager plan to provision. | `string` | `"standard"` | no |
| [sm\_tags](#input\_sm\_tags) | The list of resource tags that you want to associate with your Secrets Manager instance. | `list(string)` | `[]` | no |
diff --git a/main.tf b/main.tf
index 3876792..c641613 100644
--- a/main.tf
+++ b/main.tf
@@ -52,6 +52,25 @@ resource "ibm_resource_instance" "secrets_manager_instance" {
}
}
+# Create IAM credentials engine using s2s auth
+resource "ibm_iam_authorization_policy" "iam_identity_policy" {
+ count = var.skip_iam_authorization_policy ? 0 : 1
+ source_service_name = "secrets-manager"
+ source_resource_instance_id = local.secrets_manager_guid
+ target_service_name = "iam-identity"
+ roles = ["Operator"]
+ description = "Allows Secrets Manager instance ${local.secrets_manager_guid} `Operator` access to the IAM Identity service to enable creating IAM credentials."
+}
+
+resource "ibm_iam_authorization_policy" "iam_groups_policy" {
+ count = var.skip_iam_authorization_policy ? 0 : 1
+ source_service_name = "secrets-manager"
+ source_resource_instance_id = local.secrets_manager_guid
+ target_service_name = "iam-groups"
+ roles = ["Groups Service Member Manage"]
+ description = "Allows Secrets Manager instance ${local.secrets_manager_guid} `Groups Service Member Manage` access to the IAM Groups service to enable creating IAM credentials."
+}
+
locals {
# determine which service name to use for the policy
kms_service_name = var.kms_encryption_enabled && var.kms_key_crn != null ? (
diff --git a/tests/existing-resources/main.tf b/tests/existing-resources/main.tf
index a334989..4272c89 100644
--- a/tests/existing-resources/main.tf
+++ b/tests/existing-resources/main.tf
@@ -53,10 +53,11 @@ module "key_protect" {
##############################################################################
module "secrets_manager" {
- source = "../.."
- resource_group_id = module.resource_group.resource_group_id
- region = var.region
- secrets_manager_name = "${var.prefix}-secrets-manager" #tfsec:ignore:general-secrets-no-plaintext-exposure
- sm_service_plan = "trial"
- sm_tags = var.resource_tags
+ source = "../.."
+ resource_group_id = module.resource_group.resource_group_id
+ region = var.region
+ secrets_manager_name = "${var.prefix}-secrets-manager" #tfsec:ignore:general-secrets-no-plaintext-exposure
+ sm_service_plan = "trial"
+ sm_tags = var.resource_tags
+ skip_iam_authorization_policy = true
}
diff --git a/variables.tf b/variables.tf
index ca0d105..0dc86b7 100644
--- a/variables.tf
+++ b/variables.tf
@@ -27,6 +27,12 @@ variable "sm_service_plan" {
}
}
+variable "skip_iam_authorization_policy" {
+ type = bool
+ description = "Whether to skip the creation of the IAM authorization policies required to enable the IAM credentials engine. If set to false, a policies will be created that grants the Secrets Manager instance Operator access to the IAM identity service, and Groups Service Member Manage access to the IAM groups service."
+ default = false
+}
+
variable "sm_tags" {
type = list(string)
description = "The list of resource tags that you want to associate with your Secrets Manager instance."