From 98e7fd6dc52c5f7951263daccd56bc9fdbdf788c Mon Sep 17 00:00:00 2001 From: Jordan Date: Wed, 24 Jul 2024 16:37:16 +0100 Subject: [PATCH] feat: added the ability to scope attachments to a resource group using new input `resource_groups_scope`
* added the ability to set the attachment schedule using the new `attachment_schedule` input variable (#148) --- ibm_catalog.json | 24 +++++++++++++ solutions/instances/README.md | 3 ++ solutions/instances/main.tf | 59 +++++++++++++++++++++++--------- solutions/instances/variables.tf | 21 ++++++++++++ 4 files changed, 91 insertions(+), 16 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index d8b45d9f..37a96e29 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -232,6 +232,30 @@ { "key": "profile_attachments" }, + { + "key": "resource_groups_scope" + }, + { + "key": "attachment_schedule", + "options": [ + { + "displayname": "Daily", + "value": "daily" + }, + { + "displayname": "Weekly", + "value": "every_7_days" + }, + { + "displayname": "Monthly", + "value": "every_30_days" + }, + { + "displayname": "Never", + "value": "none" + } + ] + }, { "key": "provision_scc_workload_protection" }, diff --git a/solutions/instances/README.md b/solutions/instances/README.md index 0f9bf8eb..d0302e78 100644 --- a/solutions/instances/README.md +++ b/solutions/instances/README.md @@ -39,6 +39,7 @@ This solution supports provisioning and configuring the following infrastructure | [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/resources/en_topic) | resource | | [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/en_destinations) | data source | | [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/iam_account_settings) | data source | +| [ibm_resource_group.group](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/resource_group) | data source | | [ibm_resource_instance.scc_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/resource_instance) | data source | ### Inputs @@ -46,6 +47,7 @@ This solution supports provisioning and configuring the following infrastructure | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| | [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Whether to add a generated 4-character suffix to the created Security and Compliance Center Object Storage bucket name. Applies only if not specifying an existing bucket. Set to `false` not to add the suffix to the bucket name in the `scc_cos_bucket_name` variable. | `bool` | `true` | no | +| [attachment\_schedule](#input\_attachment\_schedule) | The scanning schedule. Possible values: `daily`, `every_7_days`, `every_30_days`, `none`. | `string` | `"daily"` | no | | [cos\_instance\_access\_tags](#input\_cos\_instance\_access\_tags) | A list of access tags to apply to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no | | [cos\_instance\_name](#input\_cos\_instance\_name) | The name for the Object Storage instance. If a prefix input variable is specified, the prefix is added to the name in the `-` format. | `string` | `"base-security-services-cos"` | no | | [cos\_instance\_tags](#input\_cos\_instance\_tags) | The list of tags to add to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no | @@ -65,6 +67,7 @@ This solution supports provisioning and configuring the following infrastructure | [profile\_attachments](#input\_profile\_attachments) | The list of Security and Compliance Center profile attachments to create that are scoped to your IBM Cloud account. The attachment schedule runs daily and defaults to the latest version of the specified profile attachments. | `list(string)` | 
[
  "IBM Cloud Framework for Financial Services"
]
| no | | [provision\_scc\_workload\_protection](#input\_provision\_scc\_workload\_protection) | Whether to provision a Workload Protection instance. | `bool` | `true` | no | | [resource\_group\_name](#input\_resource\_group\_name) | The name of a new or an existing resource group in which to provision resources to. If a prefix input variable is specified, the prefix is added to the name in the `-` format. | `string` | n/a | yes | +| [resource\_groups\_scope](#input\_resource\_groups\_scope) | The resource group to associate with the Security and Compliance Center profile attachments. If not specified, the attachments are scoped to the current account ID. Only one resource group is allowed. | `list(string)` | `[]` | no | | [scc\_cos\_bucket\_access\_tags](#input\_scc\_cos\_bucket\_access\_tags) | The list of access tags to add to the Security and Compliance Center Object Storage bucket. | `list(string)` | `[]` | no | | [scc\_cos\_bucket\_class](#input\_scc\_cos\_bucket\_class) | The storage class of the newly provisioned Security and Compliance Center Object Storage bucket. Possible values: `standard`, `vault`, `cold`, `smart`, `onerate_active`. [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-classes). | `string` | `"smart"` | no | | [scc\_cos\_bucket\_name](#input\_scc\_cos\_bucket\_name) | The name for the Security and Compliance Center Object Storage bucket. Bucket names must globally unique. If `add_bucket_name_suffix` is true, a 4-character string is added to this name to ensure it's globally unique. If a prefix input variable is specified, the prefix is added to the name in the `-` format. | `string` | `"base-security-services-bucket"` | no | diff --git a/solutions/instances/main.tf b/solutions/instances/main.tf index ec0aa80b..1578b718 100644 --- a/solutions/instances/main.tf +++ b/solutions/instances/main.tf @@ -171,6 +171,47 @@ module "scc" { # SCC Attachment ####################################################################################################################### +locals { + resource_group_supplied = length(var.resource_groups_scope) == 1 +} + +data "ibm_resource_group" "group" { + count = local.resource_group_supplied ? 1 : 0 + name = var.resource_groups_scope[0] +} + +locals { + account_scope = { + environment = "ibm-cloud" + properties = [ + { + name = "scope_type" + value = "account" + }, + { + name = "scope_id" + value = data.ibm_iam_account_settings.iam_account_settings.account_id + }, + ] + } + + resource_group_scope = { + environment = "ibm-cloud" + properties = [ + { + name = "scope_type" + value = "account.resource_group" + }, + { + name = "scope_id" + value = local.resource_group_supplied ? data.ibm_resource_group.group[0].id : null + }, + ] + } + + scope = local.resource_group_supplied ? [local.account_scope, local.resource_group_scope] : [local.account_scope] +} + # Data source to account settings data "ibm_iam_account_settings" "iam_account_settings" {} @@ -186,22 +227,8 @@ module "create_profile_attachment" { scc_instance_id = local.scc_instance_guid attachment_name = "${each.value + 1} daily full account attachment" attachment_description = "SCC profile attachment scoped to your specific IBM Cloud account id ${data.ibm_iam_account_settings.iam_account_settings.account_id} with a daily attachment schedule." - attachment_schedule = "daily" - scope = [ - { - environment = "ibm-cloud" - properties = [ - { - name = "scope_type" - value = "account" - }, - { - name = "scope_id" - value = data.ibm_iam_account_settings.iam_account_settings.account_id - }, - ] - } - ] + attachment_schedule = var.attachment_schedule + scope = local.scope } ####################################################################################################################### diff --git a/solutions/instances/variables.tf b/solutions/instances/variables.tf index c6183374..36c5f922 100644 --- a/solutions/instances/variables.tf +++ b/solutions/instances/variables.tf @@ -226,6 +226,27 @@ variable "profile_attachments" { default = ["IBM Cloud Framework for Financial Services"] } +variable "resource_groups_scope" { + type = list(string) + description = "The resource group to associate with the Security and Compliance Center profile attachments. If not specified, the attachments are scoped to the current account ID. Only one resource group is allowed." + default = [] + validation { + condition = length(var.resource_groups_scope) <= 1 + error_message = "Only one resource group is allowed." + } +} + +variable "attachment_schedule" { + type = string + description = "The scanning schedule. Possible values: `daily`, `every_7_days`, `every_30_days`, `none`." + default = "daily" + + validation { + condition = contains(["daily", "every_7_days", "every_30_days", "none"], var.attachment_schedule) + error_message = "You can set the schedule only to `daily`, `every_7_days`, `every_30_days`, or `none`." + } +} + ######################################################################################################################## # SCC Workload Protection variables ########################################################################################################################