feat: Add the ability to define the scope of SCC attachement

solutions/instances/README.md

@@ -39,13 +39,15 @@ This solution supports provisioning and configuring the following infrastructure
 | [ibm_en_topic.en_topic](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/resources/en_topic) | resource |
 | [ibm_en_destinations.en_destinations](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/en_destinations) | data source |
 | [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/iam_account_settings) | data source |
+| [ibm_resource_group.group](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/resource_group) | data source |
 | [ibm_resource_instance.scc_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.67.1/docs/data-sources/resource_instance) | data source |
 
 ### Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_add_bucket_name_suffix"></a> [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Whether to add a generated 4-character suffix to the created Security and Compliance Center Object Storage bucket name. Applies only if not specifying an existing bucket. Set to `false` not to add the suffix to the bucket name in the `scc_cos_bucket_name` variable. | `bool` | `true` | no |
+| <a name="input_attachment_schedule"></a> [attachment\_schedule](#input\_attachment\_schedule) | The schedule of an attachment. Allowable values are: daily, every\_7\_days, every\_30\_days, none. | `string` | `"daily"` | no |
 | <a name="input_cos_instance_access_tags"></a> [cos\_instance\_access\_tags](#input\_cos\_instance\_access\_tags) | A list of access tags to apply to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no |
 | <a name="input_cos_instance_name"></a> [cos\_instance\_name](#input\_cos\_instance\_name) | The name for the Object Storage instance. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-cos"` | no |
 | <a name="input_cos_instance_tags"></a> [cos\_instance\_tags](#input\_cos\_instance\_tags) | The list of tags to add to the Object Storage instance. Applies only if not specifying an existing instance. | `list(string)` | `[]` | no |
@@ -65,6 +67,7 @@ This solution supports provisioning and configuring the following infrastructure
 | <a name="input_profile_attachments"></a> [profile\_attachments](#input\_profile\_attachments) | The list of Security and Compliance Center profile attachments to create that are scoped to your IBM Cloud account. The attachment schedule runs daily and defaults to the latest version of the specified profile attachments. | `list(string)` | <pre>[<br>  "IBM Cloud Framework for Financial Services"<br>]</pre> | no |
 | <a name="input_provision_scc_workload_protection"></a> [provision\_scc\_workload\_protection](#input\_provision\_scc\_workload\_protection) | Whether to provision a Workload Protection instance. | `bool` | `true` | no |
 | <a name="input_resource_group_name"></a> [resource\_group\_name](#input\_resource\_group\_name) | The name of a new or an existing resource group in which to provision resources to. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | n/a | yes |
+| <a name="input_resource_groups_scope"></a> [resource\_groups\_scope](#input\_resource\_groups\_scope) | The resource group to scope the Security and Compliance Center profile attachments to. If left empty, it will default to being scoped to the current account id. This currently has a limitation of accepting a max number of one resource groups. | `list(string)` | `[]` | no |
 | <a name="input_scc_cos_bucket_access_tags"></a> [scc\_cos\_bucket\_access\_tags](#input\_scc\_cos\_bucket\_access\_tags) | The list of access tags to add to the Security and Compliance Center Object Storage bucket. | `list(string)` | `[]` | no |
 | <a name="input_scc_cos_bucket_class"></a> [scc\_cos\_bucket\_class](#input\_scc\_cos\_bucket\_class) | The storage class of the newly provisioned Security and Compliance Center Object Storage bucket. Possible values: `standard`, `vault`, `cold`, `smart`, `onerate_active`. [Learn more](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-classes). | `string` | `"smart"` | no |
 | <a name="input_scc_cos_bucket_name"></a> [scc\_cos\_bucket\_name](#input\_scc\_cos\_bucket\_name) | The name for the Security and Compliance Center Object Storage bucket. Bucket names must globally unique. If `add_bucket_name_suffix` is true, a 4-character string is added to this name to  ensure it's globally unique. If a prefix input variable is specified, the prefix is added to the name in the `<prefix>-<name>` format. | `string` | `"base-security-services-bucket"` | no |

solutions/instances/main.tf

@@ -171,6 +171,47 @@ module "scc" {
 # SCC Attachment
 #######################################################################################################################
 
+locals {
+  resource_group_supplied = length(var.resource_groups_scope) == 1
+}
+
+data "ibm_resource_group" "group" {
+  count = local.resource_group_supplied ? 1 : 0
+  name  = var.resource_groups_scope[0]
+}
+
+locals {
+  account_scope = {
+    environment = "ibm-cloud"
+    properties = [
+      {
+        name  = "scope_type"
+        value = "account"
+      },
+      {
+        name  = "scope_id"
+        value = data.ibm_iam_account_settings.iam_account_settings.account_id
+      },
+    ]
+  }
+
+  resource_group_scope = {
+    environment = "ibm-cloud"
+    properties = [
+      {
+        name  = "scope_type"
+        value = "account.resource_group"
+      },
+      {
+        name  = "scope_id"
+        value = local.resource_group_supplied ? data.ibm_resource_group.group[0].id : null
+      },
+    ]
+  }
+
+  scope = local.resource_group_supplied ? [local.account_scope, local.resource_group_scope] : [local.account_scope]
+}
+
 # Data source to account settings
 data "ibm_iam_account_settings" "iam_account_settings" {}
 
@@ -186,22 +227,8 @@ module "create_profile_attachment" {
   scc_instance_id        = local.scc_instance_guid
   attachment_name        = "${each.value + 1} daily full account attachment"
   attachment_description = "SCC profile attachment scoped to your specific IBM Cloud account id ${data.ibm_iam_account_settings.iam_account_settings.account_id} with a daily attachment schedule."
-  attachment_schedule    = "daily"
-  scope = [
-    {
-      environment = "ibm-cloud"
-      properties = [
-        {
-          name  = "scope_type"
-          value = "account"
-        },
-        {
-          name  = "scope_id"
-          value = data.ibm_iam_account_settings.iam_account_settings.account_id
-        },
-      ]
-    }
-  ]
+  attachment_schedule    = var.attachment_schedule
+  scope                  = local.scope
 }
 
 #######################################################################################################################

solutions/instances/variables.tf

@@ -226,6 +226,27 @@ variable "profile_attachments" {
   default     = ["IBM Cloud Framework for Financial Services"]
 }
 
+variable "resource_groups_scope" {
+  type        = list(string)
+  description = "The resource group to scope the Security and Compliance Center profile attachments to. If left empty, it will default to being scoped to the current account id. This currently has a limitation of accepting a max number of one resource groups."
+  default     = []
+  validation {
+    condition     = length(var.resource_groups_scope) <= 1
+    error_message = "Currently has a limitation of accepting a max number of one resource groups."
+  }
+}
+
+variable "attachment_schedule" {
+  type        = string
+  description = "The schedule of an attachment. Allowable values are: daily, every_7_days, every_30_days, none."
+  default     = "daily"
+
+  validation {
+    condition     = contains(["daily", "every_7_days", "every_30_days", "none"], var.attachment_schedule)
+    error_message = "Allowed schedule can be - daily, every_7_days, every_30_days, none."
+  }
+}
+
 ########################################################################################################################
 # SCC Workload Protection variables
 ########################################################################################################################