feat: fscloud profile fixes

.secrets.baseline

@@ -3,14 +3,17 @@
  "files": "go.sum|^.secrets.baseline$",
  "lines": null
  },
- "generated_at": "2023-05-05T09:58:47Z",
+ "generated_at": "2023-05-31T21:39:59Z",
  "plugins_used": [
  {
  "name": "AWSKeyDetector"
  },
  {
  "name": "ArtifactoryDetector"
  },
+ {
+ "name": "AzureStorageKeyDetector"
+ },
  {
  "base64_limit": 4.5,
  "name": "Base64HighEntropyString"
@@ -28,6 +31,9 @@
  "ghe_instance": "github.ibm.com",
  "name": "GheDetector"
  },
+ {
+ "name": "GitHubTokenDetector"
+ },
  {
  "hex_limit": 3,
  "name": "HexHighEntropyString"
@@ -48,6 +54,9 @@
  {
  "name": "MailchimpDetector"
  },
+ {
+ "name": "NpmDetector"
+ },
  {
  "name": "PrivateKeyDetector"
  },
@@ -57,6 +66,9 @@
  {
  "name": "SoftlayerDetector"
  },
+ {
+ "name": "SquareOAuthDetector"
+ },
  {
  "name": "StripeDetector"
  },

cra-tf-validate-ignore-rules.json

@@ -8,7 +8,7 @@
  },
  {
  "scc_rule_id": "rule-216e2449-27d7-4afc-929a-b66e196a9cf9",
- "description": "Check whether Flow Logs for VPC are enabled Found in: resource_address: module.event_streams.ibm_resource_instance.es_instance",
+ "description": "Check whether Flow Logs for VPC are enabled Found in: resource_address:ibm_is_vpc.example_vpc",
  "ignore_reason": "This rule is not relevant to the module itself, just the VPC resource is used in the example that is scanned",
  "is_valid": false
  }

examples/fscloud/main.tf

@@ -9,6 +9,37 @@ module "resource_group" {
  existing_resource_group_name = var.resource_group
 }
 
+##############################################################################
+# Get Cloud Account ID
+##############################################################################
+
+data "ibm_iam_account_settings" "iam_account_settings" {
+}
+
+##############################################################################
+# VPC
+##############################################################################
+resource "ibm_is_vpc" "example_vpc" {
+ name = "${var.prefix}-vpc"
+ resource_group = module.resource_group.resource_group_id
+ tags = var.resource_tags
+}
+
+##############################################################################
+# Create CBR Zone
+##############################################################################
+module "cbr_zone" {
+ source = "git::https://github.com/terraform-ibm-modules/terraform-ibm-cbr//cbr-zone-module?ref=v1.2.0"
+ name = "${var.prefix}-VPC-network-zone"
+ zone_description = "CBR Network zone representing VPC"
+ account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
+ addresses = [{
+ type = "vpc", # to bind a specific vpc to the zone
+ value = ibm_is_vpc.example_vpc.crn,
+ }]
+}
+
+
 # #############################################################################
 # Events-streams-instance
 # #############################################################################
@@ -23,4 +54,22 @@ module "event_streams" {
  schemas = var.schemas
  tags = var.resource_tags
  topics = var.topics
+ cbr_rules = [
+ {
+ description = "${var.prefix}-event stream access only from vpc"
+ enforcement_mode = "enabled"
+ account_id = data.ibm_iam_account_settings.iam_account_settings.account_id
+ rule_contexts = [{
+ attributes = [
+ {
+ "name" : "endpointType",
+ "value" : "private"
+ },
+ {
+ name = "networkZoneId"
+ value = module.cbr_zone.zone_id
+ }]
+ }]
+ }
+ ]
 }

profiles/fscloud/main.tf

@@ -11,4 +11,5 @@ module "event_streams" {
  tags = var.tags
  topics = var.topics
  service_endpoints = "private"
+ cbr_rules = var.cbr_rules
 }

profiles/fscloud/variables.tf

@@ -103,3 +103,23 @@ variable "skip_iam_authorization_policy" {
  description = "Set to true to skip the creation of an IAM authorization policy that permits all mongodb instances in the provided resource group reader access to the instance specified in the existing_kms_instance_guid variable."
  default = false
 }
+
+##############################################################
+# Context-based restriction (CBR)
+##############################################################
+
+variable "cbr_rules" {
+ type = list(object({
+ description = string
+ account_id = string
+ rule_contexts = list(object({
+ attributes = optional(list(object({
+ name = string
+ value = string
+ }))) }))
+ enforcement_mode = string
+ }))
+ description = "(Optional, list) List of CBR rules to create"
+ default = []
+ # Validation happens in the rule module
+}