Test ES DA (TESTING PURPOSE ONLY)

.secrets.baseline

@@ -3,7 +3,7 @@
     "files": "go.sum|^.secrets.baseline$|^../.secrets.baseline$",
     "lines": null
   },
-  "generated_at": "2024-03-27T22:08:26Z",
+  "generated_at": "2024-07-29T08:18:41Z",
   "plugins_used": [
     {
       "name": "AWSKeyDetector"

examples/complete/README.md

@@ -9,27 +9,32 @@ This examples handles the provisioning of a new Secrets Manager instance.
 |------|---------|
 | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= v1.0.0 |
 | <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >= 1.65.0 |
+| <a name="requirement_time"></a> [time](#requirement\_time) | 0.11.2 |
 
 ### Modules
 
 | Name | Source | Version |
 |------|--------|---------|
 | <a name="module_event_notification"></a> [event\_notification](#module\_event\_notification) | terraform-ibm-modules/event-notifications/ibm | 1.6.5 |
+| <a name="module_icd_elasticsearch"></a> [icd\_elasticsearch](#module\_icd\_elasticsearch) | terraform-ibm-modules/icd-elasticsearch/ibm | 1.14.5 |
 | <a name="module_key_protect"></a> [key\_protect](#module\_key\_protect) | terraform-ibm-modules/kms-all-inclusive/ibm | 4.13.4 |
 | <a name="module_resource_group"></a> [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.1.6 |
 | <a name="module_secrets_manager"></a> [secrets\_manager](#module\_secrets\_manager) | ../.. | n/a |
 
 ### Resources
 
-No resources.
+| Name | Type |
+|------|------|
+| [ibm_iam_authorization_policy.policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
+| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.11.2/docs/resources/sleep) | resource |
 
 ### Inputs
 
 | Name | Description | Type | Default | Required |
 |------|-------------|------|---------|:--------:|
 | <a name="input_en_region"></a> [en\_region](#input\_en\_region) | Region where event notification will be created | `string` | `"au-syd"` | no |
 | <a name="input_ibmcloud_api_key"></a> [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The IBM Cloud API key this account authenticates to | `string` | n/a | yes |
-| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix for sm instance | `string` | `"sm-com"` | no |
+| <a name="input_prefix"></a> [prefix](#input\_prefix) | Prefix for sm instance | `string` | `"dishank-sm-com"` | no |
 | <a name="input_region"></a> [region](#input\_region) | Region where resources will be created | `string` | `"us-east"` | no |
 | <a name="input_resource_group"></a> [resource\_group](#input\_resource\_group) | An existing resource group name to use for this example, if unset a new resource group will be created | `string` | `null` | no |
 | <a name="input_resource_tags"></a> [resource\_tags](#input\_resource\_tags) | Optional list of tags to be added to created resources | `list(string)` | `[]` | no |

examples/complete/main.tf

@@ -37,7 +37,30 @@ module "event_notification" {
   region            = var.en_region
 }
 
+module "icd_elasticsearch" {
+  source            = "terraform-ibm-modules/icd-elasticsearch/ibm"
+  version           = "1.14.5"
+  resource_group_id = module.resource_group.resource_group_id
+  name              = "dishank-test"
+  region            = var.region
+}
+
+resource "ibm_iam_authorization_policy" "policy" {
+  depends_on                  = [module.icd_elasticsearch]
+  source_service_name         = "secrets-manager"
+  source_resource_group_id    = module.resource_group.resource_group_id
+  target_service_name         = "databases-for-elasticsearch"
+  target_resource_instance_id = module.icd_elasticsearch.id
+  roles                       = ["Key Manager"]
+}
+
+resource "time_sleep" "wait_for_authorization_policy" {
+  depends_on      = [ibm_iam_authorization_policy.policy]
+  create_duration = "30s"
+}
+
 module "secrets_manager" {
+  depends_on                 = [time_sleep.wait_for_authorization_policy]
   source                     = "../.."
   resource_group_id          = module.resource_group.resource_group_id
   region                     = var.region
@@ -51,7 +74,7 @@ module "secrets_manager" {
   existing_en_instance_crn   = module.event_notification.crn
   secrets = [
     {
-      secret_group_name = "${var.prefix}-secret-group"
+      secret_group_name = "${var.prefix}-secret-group" #checkov:skip=CKV_SECRET_6
       secrets = [{
         secret_name             = "${var.prefix}-kp-key-crn"
         secret_type             = "arbitrary"
@@ -68,6 +91,19 @@ module "secrets_manager" {
         secret_payload_password = module.key_protect.keys["${var.prefix}-sm.${var.prefix}-sm-key"].key_id
         }
       ]
+      }, {
+      secret_group_name = "test-dishank" #checkov:skip=CKV_SECRET_6
+      secrets = [{
+        secret_name                             = "dishank-cred-1"
+        service_credentials_source_service_role = "Editor"
+        secret_type                             = "service_credentials" # checkov:skip=CKV_SECRET_6
+        service_credentials_source_service_crn  = module.icd_elasticsearch.id
+        }, {
+        secret_name                             = "dishank-cred-2"
+        service_credentials_source_service_role = "Editor"
+        secret_type                             = "service_credentials" # checkov:skip=CKV_SECRET_6
+        service_credentials_source_service_crn  = module.icd_elasticsearch.id
+      }]
     }
   ]
 }

examples/complete/variables.tf

@@ -7,7 +7,7 @@ variable "ibmcloud_api_key" {
 variable "prefix" {
   type        = string
   description = "Prefix for sm instance"
-  default     = "sm-com"
+  default     = "dishank-sm-com"
 }
 variable "sm_service_plan" {
   type        = string

examples/complete/version.tf

@@ -5,5 +5,9 @@ terraform {
       source  = "IBM-Cloud/ibm"
       version = ">= 1.65.0"
     }
+    time = {
+      source  = "hashicorp/time"
+      version = "0.11.2"
+    }
   }
 }

tests/other_test.go

@@ -11,7 +11,6 @@ import (
 
 func TestRunBasicExample(t *testing.T) {
 	t.Parallel()
-
 	options := testhelper.TestOptionsDefaultWithVars(&testhelper.TestOptions{
 		Testing:      t,
 		TerraformDir: "examples/basic",
@@ -23,16 +22,6 @@ func TestRunBasicExample(t *testing.T) {
 	assert.NotNil(t, output, "Expected some output")
 }
 
-func TestRunCompleteExample(t *testing.T) {
-	t.Parallel()
-
-	options := setupOptions(t, "secrets-mgr")
-
-	output, err := options.RunTestConsistency()
-	assert.Nil(t, err, "This should not have errored")
-	assert.NotNil(t, output, "Expected some output")
-}
-
 func TestFSCloudInSchematics(t *testing.T) {
 	t.Parallel()
 

tests/pr_test.go

@@ -69,7 +69,18 @@ func setupOptions(t *testing.T, prefix string) *testhelper.TestOptions {
 	return options
 }
 
+func TestRunCompleteExample(t *testing.T) {
+	t.Parallel()
+
+	options := setupOptions(t, "secrets-mgr")
+
+	output, err := options.RunTestConsistency()
+	assert.Nil(t, err, "This should not have errored")
+	assert.NotNil(t, output, "Expected some output")
+}
+
 func TestRunUpgradeExample(t *testing.T) {
+	t.Skip()
 	t.Parallel()
 
 	options := setupOptions(t, "secrets-mgr-upg")
@@ -82,6 +93,7 @@ func TestRunUpgradeExample(t *testing.T) {
 }
 
 func TestRunDASolutionSchematics(t *testing.T) {
+	t.Skip()
 	t.Parallel()
 
 	acme_letsencrypt_private_key := GetSecretsManagerKey( // pragma: allowlist secret
@@ -146,6 +158,7 @@ func GetSecretsManagerKey(sm_id string, sm_region string, sm_key_id string) *str
 
 // A test to pass existing resources to the SM DA
 func TestRunExistingResourcesInstances(t *testing.T) {
+	t.Skip()
 	t.Parallel()
 
 	// ------------------------------------------------------------------------------------
@@ -166,9 +179,10 @@ func TestRunExistingResourcesInstances(t *testing.T) {
 	existingTerraformOptions := terraform.WithDefaultRetryableErrors(t, &terraform.Options{
 		TerraformDir: tempTerraformDir + "/tests/existing-resources",
 		Vars: map[string]interface{}{
-			"prefix":        prefix,
-			"region":        region,
-			"resource_tags": tags,
+			"prefix":                   prefix,
+			"region":                   "us-south",
+			"resource_tags":            tags,
+			"existing_sm_instance_crn": "crn:v1:bluemix:public:secrets-manager:us-south:a/abac0df06b644a9cabc6e44f55b3880e:79c6d411-c18f-4670-b009-b0044a238667::",
 		},
 		// Set Upgrade to true to ensure latest version of providers and modules are used by terratest.
 		// This is the same as setting the -upgrade=true flag with terraform.