feat: Add the ability to define the scope of SCC attachement

solutions/instances/README.md

@@ -63,6 +63,7 @@ This solution supports provisioning and configuring the following infrastructure
 | <a name="input_profile_attachments"></a> [profile\_attachments](#input\_profile\_attachments) | The list of Security and Compliance Center profile attachments to create that are scoped to your IBM Cloud account. The attachment schedule runs daily and defaults to the latest version of the specified profile attachments. | `list(string)` | <pre>[<br>  "IBM Cloud Framework for Financial Services"<br>]</pre> | no |
 | <a name="input_provision_scc_workload_protection"></a> [provision\_scc\_workload\_protection](#input\_provision\_scc\_workload\_protection) | Whether to provision a Workload Protection instance. | `bool` | `true` | no |
 | <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of a new or an existing resource group in which to provision resources to. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | n/a | yes |
+| <a name="input_resource_groups_scope"></a> [resource\_groups\_scope](#input\_resource\_groups\_scope) | The resource group to scope the Security and Compliance Center profile attachments to. If left empty, the default scoped resource group will be set to the existing or new resource group passed to this module. Currently has a limitation of accepting only one resource group, but with support to add multiple resource groups coming in the future. | `list(string)` | `[]` | no |
 | <a name="input_scc_cos_bucket_access_tags"></a> [scc\_cos\_bucket\_access\_tags](#input\_scc\_cos\_bucket\_access\_tags) | The list of access tags to add to the Security and Compliance Center Object Storage bucket. | `list(string)` | `[]` | no |
 | <a name="input_scc_cos_bucket_class"></a> [scc\_cos\_bucket\_class](#input\_scc\_cos\_bucket\_class) | The storage class of the newly provisioned Security and Compliance Center Object Storage bucket. Possible values: `standard`, `vault`, `cold`, `smart`, `onerate_active`. [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-classes). | `string` | `"smart"` | no |
 | <a name="input_scc_cos_bucket_name"></a> [scc\_cos\_bucket\_name](#input\_scc\_cos\_bucket\_name) | The name for the Security and Compliance Center Object Storage bucket. Bucket names must globally unique. If `add_bucket_name_suffix` is true, a 4-character string is added to this name to  ensure it's globally unique. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-bucket"` | no |

solutions/instances/main.tf

@@ -151,6 +151,15 @@ module "scc" {
 # SCC Attachment
 #######################################################################################################################
 
+locals {
+  resource_groups_scope = length(var.resource_groups_scope) == 1 ? var.resource_groups_scope[0] : null
+
+  rg_scope = local.resource_groups_scope != null ? {
+    name  = "scope_id"
+    value = local.resource_groups_scope
+  } : null
+}
+
 # Data source to account settings
 data "ibm_iam_account_settings" "iam_account_settings" {}
 
@@ -180,7 +189,17 @@ module "create_profile_attachment" {
           value = data.ibm_iam_account_settings.iam_account_settings.account_id
         },
       ]
-    }
+    },
+    {
+      environment = "ibm-cloud"
+      properties = [
+        {
+          name  = "scope_type"
+          value = "account.resource_group"
+        },
+        local.rg_scope,
+      ]
+    },
   ]
 }
 

solutions/instances/variables.tf

@@ -220,6 +220,12 @@ variable "profile_attachments" {
   default     = ["IBM Cloud Framework for Financial Services"]
 }
 
+variable "resource_groups_scope" {
+  type        = list(string)
+  description = "The resource group to scope the Security and Compliance Center profile attachments to. If left empty, the default scoped resource group will be set to the existing or new resource group passed to this module. Currently has a limitation of accepting only one resource group, but with support to add multiple resource groups coming in the future."
+  default     = []
+}
+
 ########################################################################################################################
 # SCC Workload Protection variables
 ########################################################################################################################