From fa79ece39380d54c2979eea5810b36eaba170527 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Wed, 18 Jun 2025 19:01:12 +0530 Subject: [PATCH 01/16] improve DA user experience --- ibm_catalog.json | 18 +++- reference-architectures/en.svg | 4 +- solutions/fully-configurable/README.md | 113 +--------------------- solutions/fully-configurable/variables.tf | 20 ++-- 4 files changed, 31 insertions(+), 124 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index c8f70f6c..db4b093e 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -474,6 +474,7 @@ }, { "key": "management_endpoint_type_for_bucket", + "hidden": true, "options": [ { "displayname": "public", @@ -490,6 +491,7 @@ }, { "key": "existing_secrets_manager_endpoint_type", + "hidden": true, "options": [ { "displayname": "private", @@ -505,13 +507,25 @@ "key": "skip_event_notifications_secrets_manager_auth_policy" }, { - "key": "service_credential_secrets" + "key": "service_credential_secrets", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "service_credential_names" }, { - "key": "cbr_rules" + "key": "cbr_rules", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } } ], "iam_permissions": [ diff --git a/reference-architectures/en.svg b/reference-architectures/en.svg index d7b0d9fa..dc25a0e5 100644 --- a/reference-architectures/en.svg +++ b/reference-architectures/en.svg @@ -1,4 +1,4 @@ - + -
IBM Cloud
IBM Cloud
Region
Region
Existing Resource Group
Existing Resource GroupEventNotifications
                      (Optional) Existing KMS
(Optional)...
Key Ring
Key RingRoot Key
                       (Optional) Existing COS
(Optional...
Bucket
Bucket
Failed Event
Faile...
....Text is not SVG - cannot display \ No newline at end of file +
IBM Cloud
IBM Cloud
Region
RegionEventNotifications
Existing Resource Group
Existing Resource GroupCloud LogsCloud logs for ActivityTrackerCloud Monitoring
Observability
Observabili...
[Optional]
[Optiona...
                    Cloud Object Storage
Cloud Object...
Bucket
Bucket
Failed Event
Faile...
....
KMS
KMS
Key Ring
Key RingRoot KeyText is not SVG - cannot display diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index 0df89932..d9c88c6e 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -1,112 +1,3 @@ -# Cloud automation for Event Notifications (Fully configurable) +# Cloud automation for Event Notification (Fully configurable) -## Prerequisites -- An existing resource group - -When `existing_en_instance_crn` is not passed, this solution configures the following infrastructure: - -- optionally a KMS key ring -- optionally a KMS key for IBM Event Notifications encryption -- optionally a KMS key for IBM Cloud Object Storage encryption -- optionally an IBM Cloud Object Storage bucket to collect events that fail delivery -- an IBM Event Notifications instance - -When `existing_en_instance_crn` is passed, this solution ignores ALL other inputs and sets the outputs based on the CRN. - - -:exclamation: **Important:** This solution is not intended to be called by one or more other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). - -![event-notifications-deployable-architecture](../../reference-architecture/en.svg) - - - -### Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.9.0 | -| [ibm](#requirement\_ibm) | 1.79.2 | -| [time](#requirement\_time) | 0.13.1 | - -### Modules - -| Name | Source | Version | -|------|--------|---------| -| [cos\_buckets](#module\_cos\_buckets) | terraform-ibm-modules/cos/ibm//modules/buckets | 9.0.6 | -| [cos\_kms\_key\_crn\_parser](#module\_cos\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [event\_notifications](#module\_event\_notifications) | ../.. | n/a | -| [existing\_cos\_crn\_parser](#module\_existing\_cos\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_en\_crn\_parser](#module\_existing\_en\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_kms\_crn\_parser](#module\_existing\_kms\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_kms\_key\_crn\_parser](#module\_existing\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_sm\_crn\_parser](#module\_existing\_sm\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 5.1.8 | -| [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.2.1 | -| [secrets\_manager\_service\_credentials](#module\_secrets\_manager\_service\_credentials) | terraform-ibm-modules/secrets-manager/ibm//modules/secrets | 2.6.1 | - -### Resources - -| Name | Type | -|------|------| -| [ibm_iam_authorization_policy.cos_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/resources/iam_authorization_policy) | resource | -| [ibm_iam_authorization_policy.en_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/resources/iam_authorization_policy) | resource | -| [ibm_iam_authorization_policy.secrets_manager_key_manager](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/resources/iam_authorization_policy) | resource | -| [time_sleep.wait_for_en_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource | -| [ibm_resource_instance.existing_en_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/data-sources/resource_instance) | data source | - -### Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Whether to add a randomly generated 4-character suffix to the newly provisioned Object Storage bucket name. Set to `false` if you want full control over bucket naming by using the `cos_bucket_name` variable. | `bool` | `true` | no | -| [cbr\_rules](#input\_cbr\_rules) | The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md) | 
list(object({
    description = string
    account_id  = string
    rule_contexts = list(object({
      attributes = optional(list(object({
        name  = string
        value = string
    }))) }))
    enforcement_mode = string
    operations = optional(list(object({
      api_types = list(object({
        api_type_id = string
      }))
    })))
  }))
| `[]` | no | -| [cos\_bucket\_access\_tags](#input\_cos\_bucket\_access\_tags) | A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no | -| [cos\_bucket\_class](#input\_cos\_bucket\_class) | The storage class of the newly provisioned Cloud Object Storage bucket. Specify one of the following values for the storage class: `standard`, `vault`, `cold`, `smart` (default), or `onerate_active`. | `string` | `"standard"` | no | -| [cos\_bucket\_name](#input\_cos\_bucket\_name) | The name to use when creating the Object Storage bucket for the storage of failed delivery events. Bucket names are globally unique. If `add_bucket_name_suffix` is set to `true`, a random 4 character string is added to this name to help ensure that the bucket name is unique. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"base-event-notifications-bucket"` | no | -| [cos\_bucket\_region](#input\_cos\_bucket\_region) | The COS bucket region. If `cos_bucket_region` is set to null, then `region` will be used. | `string` | `null` | no | -| [cos\_key\_name](#input\_cos\_key\_name) | The name of the key which will be created for the Event Notifications. Not used if supplying an existing key. Only use if 'enable\_collecting\_failed\_events' is true. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-cos-key"` | no | -| [enable\_collecting\_failed\_events](#input\_enable\_collecting\_failed\_events) | Set to true to enable Cloud Object Storage integration. If true a Cloud Object Storage instance to store failed events in should also be passed using variable `existing_cos_instance_crn`. For more info see https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-cfe-integrations. | `bool` | `false` | no | -| [event\_notifications\_access\_tags](#input\_event\_notifications\_access\_tags) | A list of access tags to apply to the Event Notifications instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no | -| [event\_notifications\_instance\_name](#input\_event\_notifications\_instance\_name) | The name of the Event Notifications instance that is created by this solution. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications"` | no | -| [event\_notifications\_key\_name](#input\_event\_notifications\_key\_name) | The name for the key that will be created for the Event Notifications instance. Not used if an existing key is specified. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-key"` | no | -| [event\_notifications\_key\_ring\_name](#input\_event\_notifications\_key\_ring\_name) | The name of the key ring which will be created for the Event Notifications instance. Not used if supplying an existing key. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-key-ring"` | no | -| [event\_notifications\_resource\_tags](#input\_event\_notifications\_resource\_tags) | The list of tags to add to the Event Notifications instance. | `list(string)` | `[]` | no | -| [existing\_cos\_instance\_crn](#input\_existing\_cos\_instance\_crn) | The CRN of an IBM Cloud Object Storage instance. If not supplied, Cloud Object Storage will not be configured. To use, 'enable\_collecting\_failed\_events' must be set to true. | `string` | `null` | no | -| [existing\_event\_notifications\_instance\_crn](#input\_existing\_event\_notifications\_instance\_crn) | The CRN of existing Event Notifications instance. If not supplied, a new instance is created. | `string` | `null` | no | -| [existing\_kms\_instance\_crn](#input\_existing\_kms\_instance\_crn) | The CRN of the KMS instance (Hyper Protect Crypto Services or Key Protect instance). If the KMS instance is in different account you must also provide a value for `ibmcloud_kms_api_key`. To use an existing kms instance you must also provide a value for 'kms\_endpoint\_url' and 'existing\_kms\_root\_key\_crn' should be null. A value should not be passed passing existing EN instance using the `existing_event_notifications_instance_crn` input. | `string` | `null` | no | -| [existing\_kms\_root\_key\_crn](#input\_existing\_kms\_root\_key\_crn) | The key CRN of a root key which will be used to encrypt the data. To use an existing key you must also provide a value for 'kms\_endpoint\_url' and 'existing\_kms\_instance\_crn' should be null. If no value passed, a new key will be created in the instance provided in the `existing_kms_instance_crn` input. | `string` | `null` | no | -| [existing\_monitoring\_crn](#input\_existing\_monitoring\_crn) | The CRN of an IBM Cloud Monitoring instance used to monitor the IBM Cloud Object Storage bucket that is used for storing failed events. Only applicable if failed events are enabled using the `enable_collecting_failed_events` input. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. | `string` | `null` | no | -| [existing\_resource\_group\_name](#input\_existing\_resource\_group\_name) | The name of an existing resource group to provision the resources. | `string` | `"Default"` | no | -| [existing\_secrets\_manager\_endpoint\_type](#input\_existing\_secrets\_manager\_endpoint\_type) | The endpoint type to use if `existing_secrets_manager_instance_crn` is specified. Possible values: public, private. | `string` | `"private"` | no | -| [existing\_secrets\_manager\_instance\_crn](#input\_existing\_secrets\_manager\_instance\_crn) | The CRN of existing secrets manager to use to create service credential secrets for Event Notification instance. | `string` | `null` | no | -| [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The API key to use for IBM Cloud. | `string` | n/a | yes | -| [ibmcloud\_kms\_api\_key](#input\_ibmcloud\_kms\_api\_key) | The IBM Cloud API key that can create a root key and key ring in the key management service (KMS) instance. If not specified, the 'ibmcloud\_api\_key' variable is used. Specify this key if the instance in `existing_kms_instance_crn` is in an account that's different from the Event Notifications instance. Leave this input empty if the same account owns both instances. | `string` | `null` | no | -| [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set to true to enable KMS encryption on Event Notifications instance and Cloud Object Storage bucket. When set to true 'kms\_endpoint\_url' and one of 'existing\_kms\_instance\_crn' or 'existing\_kms\_root\_key\_crn' must be set. | `bool` | `false` | no | -| [kms\_endpoint\_type](#input\_kms\_endpoint\_type) | The type of the endpoint that is used for communicating with the KMS instance. Possible values: `public` or `private` (default). Only used if not supplying an existing root key. | `string` | `"private"` | no | -| [kms\_endpoint\_url](#input\_kms\_endpoint\_url) | The KMS endpoint URL to use when you configure KMS encryption. When set to true, a value must be passed for either `existing_kms_root_key_crn` or `existing_kms_instance_crn` (to create a new key). The Hyper Protect Crypto Services endpoint URL format is `https://api.private..hs-crypto.cloud.ibm.com:` and the Key Protect endpoint URL format is `https://.kms.cloud.ibm.com`. Not required if passing an existing instance using the `existing_event_notifications_instance_crn` input. | `string` | `null` | no | -| [management\_endpoint\_type\_for\_bucket](#input\_management\_endpoint\_type\_for\_bucket) | The type of endpoint for the IBM Terraform provider to use to manage Object Storage buckets. Available values: `public` or `direct`. | `string` | `"direct"` | no | -| [prefix](#input\_prefix) | Prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes | -| [provider\_visibility](#input\_provider\_visibility) | Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints). | `string` | `"private"` | no | -| [region](#input\_region) | The region in which the Event Notifications resources are provisioned. | `string` | `"us-south"` | no | -| [service\_credential\_names](#input\_service\_credential\_names) | The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets | `map(string)` | `{}` | no | -| [service\_credential\_secrets](#input\_service\_credential\_secrets) | Service credential secrets configuration for Event Notification. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets). | 
list(object({
    secret_group_name        = string
    secret_group_description = optional(string)
    existing_secret_group    = optional(bool)
    service_credentials = list(object({
      secret_name                                 = string
      service_credentials_source_service_role_crn = string
      secret_labels                               = optional(list(string))
      secret_auto_rotation                        = optional(bool)
      secret_auto_rotation_unit                   = optional(string)
      secret_auto_rotation_interval               = optional(number)
      service_credentials_ttl                     = optional(string)
      service_credential_secret_description       = optional(string)

    }))
  }))
| `[]` | no | -| [service\_endpoints](#input\_service\_endpoints) | Specify whether you want to enable public, private, or both public and private service endpoints. Possible values: `public`, `private`, `public-and-private` | `string` | `"private"` | no | -| [service\_plan](#input\_service\_plan) | The pricing plan of the Event Notifications instance. Possible values: `Lite`, `Standard` | `string` | `"standard"` | no | -| [skip\_cos\_kms\_auth\_policy](#input\_skip\_cos\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the COS instance to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_key_management_service_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | -| [skip\_event\_notifications\_cos\_auth\_policy](#input\_skip\_event\_notifications\_cos\_auth\_policy) | Set to `true` to skip the creation of an IAM authorization policy that permits the Event Notifications instance `Object Writer` and `Reader` access to the given Object Storage bucket. Set to `true` to use an existing policy. | `bool` | `false` | no | -| [skip\_event\_notifications\_kms\_auth\_policy](#input\_skip\_event\_notifications\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the Event Notifications instance to read the encryption key from the KMS instance. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | -| [skip\_event\_notifications\_secrets\_manager\_auth\_policy](#input\_skip\_event\_notifications\_secrets\_manager\_auth\_policy) | Whether an IAM authorization policy is created for Secrets Manager instance to create a service credential secrets for Event Notification.If set to false, the Secrets Manager instance passed by the user is granted the Key Manager access to the Event Notifications instance created by the Deployable Architecture. Set to `true` to use an existing policy. The value of this is ignored if any value for 'existing\_secrets\_manager\_instance\_crn' is not passed. | `bool` | `false` | no | - -### Outputs - -| Name | Description | -|------|-------------| -| [crn](#output\_crn) | Event Notification crn | -| [crn\_list\_object](#output\_crn\_list\_object) | A list of objects containing the CRN of the Event Notifications instance | -| [event\_notification\_instance\_name](#output\_event\_notification\_instance\_name) | Event Notification name | -| [guid](#output\_guid) | Event Notification guid | -| [service\_credential\_secret\_groups](#output\_service\_credential\_secret\_groups) | Service credential secret groups | -| [service\_credential\_secrets](#output\_service\_credential\_secrets) | Service credential secrets | -| [service\_credentials\_json](#output\_service\_credentials\_json) | Service credentials json map | -| [service\_credentials\_object](#output\_service\_credentials\_object) | Service credentials object | - +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index d78d9107..08f8c031 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -26,7 +26,7 @@ variable "provider_visibility" { variable "region" { type = string - description = "The region in which the Event Notifications resources are provisioned." + description = "The region in which the Event Notifications resources are provisioned. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/region) about how to select different regions for different services." default = "us-south" } @@ -39,15 +39,17 @@ variable "existing_monitoring_crn" { variable "prefix" { type = string - description = "Prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: en-0435. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix)." validation { - condition = (var.prefix == null ? true : - alltrue([ - can(regex("^[a-z]{0,1}[-a-z0-9]{0,14}[a-z0-9]{0,1}$", var.prefix)), - length(regexall("^.*--.*", var.prefix)) == 0 - ]) - ) - error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 16 or fewer characters." + condition = var.prefix == null || var.prefix == "" ? true : alltrue([ + can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), length(regexall("--", var.prefix)) == 0 + ]) + error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." + } + + validation { + condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 + error_message = "Prefix must not exceed 16 characters." } } From 700ef6c1055d8eb554b670ef9b36b7e122538fb7 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Wed, 18 Jun 2025 19:33:20 +0530 Subject: [PATCH 02/16] update secrets --- .secrets.baseline | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) diff --git a/.secrets.baseline b/.secrets.baseline index 3efa2818..a1a00f99 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "go.sum|^.secrets.baseline$", "lines": null }, - "generated_at": "2025-05-12T16:40:05Z", + "generated_at": "2025-06-18T13:35:28Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -87,16 +87,6 @@ "verified_result": null } ], - "solutions/fully-configurable/README.md": [ - { - "hashed_secret": "99046450b7d19bfd57bfe3773719f57af84c7f12", - "is_secret": false, - "is_verified": false, - "line_number": 92, - "type": "Secret Keyword", - "verified_result": null - } - ], "solutions/security-enforced/README.md": [ { "hashed_secret": "99046450b7d19bfd57bfe3773719f57af84c7f12", From 936fd9d1c26bb63daaa1e048b9872a215926c256 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Wed, 18 Jun 2025 14:21:03 +0000 Subject: [PATCH 03/16] resolve pc --- .secrets.baseline | 12 +--- solutions/security-enforced/README.md | 87 +-------------------------- 2 files changed, 3 insertions(+), 96 deletions(-) diff --git a/.secrets.baseline b/.secrets.baseline index a1a00f99..6afcbb7b 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "go.sum|^.secrets.baseline$", "lines": null }, - "generated_at": "2025-06-18T13:35:28Z", + "generated_at": "2025-06-18T14:13:24Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -86,16 +86,6 @@ "type": "Secret Keyword", "verified_result": null } - ], - "solutions/security-enforced/README.md": [ - { - "hashed_secret": "99046450b7d19bfd57bfe3773719f57af84c7f12", - "is_secret": false, - "is_verified": false, - "line_number": 68, - "type": "Secret Keyword", - "verified_result": null - } ] }, "version": "0.13.1+ibm.62.dss", diff --git a/solutions/security-enforced/README.md b/solutions/security-enforced/README.md index 2bc9c86e..40e78b59 100644 --- a/solutions/security-enforced/README.md +++ b/solutions/security-enforced/README.md @@ -1,86 +1,3 @@ -# Cloud automation for Event Notifications (Security Enforced) +# Cloud automation for Event Notification (Security Enforced) -## Prerequisites -- An existing resource group -- An existing COS instance -- An existing KMS instance (or key) if you want to encrypt the COS bucket and Event Notifications - -When `existing_event_notifications_instance_crn` is not passed, this solution configures the following infrastructure: - -- a KMS key ring and key for IBM Event Notifications encryption -- a KMS key ring and key for IBM Cloud Object Storage encryption -- an IBM Cloud Object Storage bucket to collect events that fail delivery -- an IBM Event Notifications instance - -When `existing_event_notifications_instance_crn` is passed, this solution ignores ALL other inputs and sets the outputs based on the CRN. - -- required inputs MUST still be set, but will be ignored. - -:exclamation: **Important:** This solution is not intended to be called by one or more other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). - -![event-notifications-deployable-architecture](../../reference-architecture/en.svg) - - - -### Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.9.0 | - -### Modules - -| Name | Source | Version | -|------|--------|---------| -| [event\_notifications](#module\_event\_notifications) | ../fully-configurable | n/a | - -### Resources - -No resources. - -### Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Whether to add a randomly generated 4-character suffix to the newly provisioned Object Storage bucket name. Set to `false` if you want full control over bucket naming by using the `cos_bucket_name` variable. | `bool` | `true` | no | -| [cbr\_rules](#input\_cbr\_rules) | The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md) | 
list(object({
    description = string
    account_id  = string
    rule_contexts = list(object({
      attributes = optional(list(object({
        name  = string
        value = string
    }))) }))
    enforcement_mode = string
    operations = optional(list(object({
      api_types = list(object({
        api_type_id = string
      }))
    })))
  }))
| `[]` | no | -| [cos\_bucket\_access\_tags](#input\_cos\_bucket\_access\_tags) | A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial. | `list(string)` | `[]` | no | -| [cos\_bucket\_name](#input\_cos\_bucket\_name) | The name to use when creating the Object Storage bucket for the storage of failed delivery events. Bucket names are globally unique. If `add_bucket_name_suffix` is set to `true`, a random 4 character string is added to this name to help ensure that the bucket name is unique. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"base-event-notifications-bucket"` | no | -| [cos\_bucket\_region](#input\_cos\_bucket\_region) | The COS bucket region. If `cos_bucket_region` is set to null, then `region` will be used. | `string` | `null` | no | -| [cos\_key\_name](#input\_cos\_key\_name) | The name of the key which will be created for the Event Notifications. Not used if supplying an existing key. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-cos-key"` | no | -| [event\_notifications\_instance\_name](#input\_event\_notifications\_instance\_name) | The name of the Event Notifications instance that is created by this solution. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications"` | no | -| [event\_notifications\_key\_name](#input\_event\_notifications\_key\_name) | The name for the key that will be created for the Event Notifications instance. Not used if an existing key is specified. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-key"` | no | -| [event\_notifications\_key\_ring\_name](#input\_event\_notifications\_key\_ring\_name) | The name of the key ring which will be created for the Event Notifications instance. Not used if supplying an existing key. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-key-ring"` | no | -| [event\_notifications\_resource\_tags](#input\_event\_notifications\_resource\_tags) | The list of tags to add to the Event Notifications instance. | `list(string)` | `[]` | no | -| [existing\_cos\_instance\_crn](#input\_existing\_cos\_instance\_crn) | The CRN of an IBM Cloud Object Storage instance. If not supplied, Cloud Object Storage will not be configured. | `string` | `null` | no | -| [existing\_event\_notifications\_instance\_crn](#input\_existing\_event\_notifications\_instance\_crn) | The CRN of existing Event Notifications instance. If not supplied, a new instance is created. | `string` | `null` | no | -| [existing\_kms\_instance\_crn](#input\_existing\_kms\_instance\_crn) | The CRN of the KMS instance (Hyper Protect Crypto Services or Key Protect instance). If the KMS instance is in different account you must also provide a value for `ibmcloud_kms_api_key`. To use an existing kms instance you must also provide a value for 'kms\_endpoint\_url' and 'existing\_kms\_root\_key\_crn' should be null. A value should not be passed passing existing EN instance using the `existing_event_notifications_instance_crn` input. | `string` | `null` | no | -| [existing\_kms\_root\_key\_crn](#input\_existing\_kms\_root\_key\_crn) | The key CRN of a root key which will be used to encrypt the data. To use an existing key you must also provide a value for 'kms\_endpoint\_url' and 'existing\_kms\_instance\_crn' should be null. If no value passed, a new key will be created in the instance provided in the `existing_kms_instance_crn` input. | `string` | `null` | no | -| [existing\_monitoring\_crn](#input\_existing\_monitoring\_crn) | The CRN of an IBM Cloud Monitoring instance used to monitor the IBM Cloud Object Storage bucket that is used for storing failed events. Only applicable if failed events are enabled using the `enable_collecting_failed_events` input. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. | `string` | `null` | no | -| [existing\_resource\_group\_name](#input\_existing\_resource\_group\_name) | The name of an existing resource group to provision the resources. | `string` | `"Default"` | no | -| [existing\_secrets\_manager\_instance\_crn](#input\_existing\_secrets\_manager\_instance\_crn) | The CRN of existing secrets manager to use to create service credential secrets for Event Notification instance. | `string` | `null` | no | -| [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The API key to use for IBM Cloud. | `string` | n/a | yes | -| [ibmcloud\_kms\_api\_key](#input\_ibmcloud\_kms\_api\_key) | The IBM Cloud API key that can create a root key and key ring in the key management service (KMS) instance. If not specified, the 'ibmcloud\_api\_key' variable is used. Specify this key if the instance in `existing_kms_instance_crn` is in an account that's different from the Event Notifications instance. Leave this input empty if the same account owns both instances. | `string` | `null` | no | -| [kms\_endpoint\_url](#input\_kms\_endpoint\_url) | The KMS endpoint URL to use when you configure KMS encryption. When set to true, a value must be passed for either `existing_kms_root_key_crn` or `existing_kms_instance_crn` (to create a new key). The Hyper Protect Crypto Services endpoint URL format is `https://api.private..hs-crypto.cloud.ibm.com:` and the Key Protect endpoint URL format is `https://.kms.cloud.ibm.com`. Not required if passing an existing instance using the `existing_event_notifications_instance_crn` input. | `string` | `null` | no | -| [prefix](#input\_prefix) | Prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes | -| [region](#input\_region) | The region in which the Event Notifications resources are provisioned. | `string` | `"us-south"` | no | -| [service\_credential\_names](#input\_service\_credential\_names) | The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets | `map(string)` | `{}` | no | -| [service\_credential\_secrets](#input\_service\_credential\_secrets) | Service credential secrets configuration for Event Notification. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets). | 
list(object({
    secret_group_name        = string
    secret_group_description = optional(string)
    existing_secret_group    = optional(bool)
    service_credentials = list(object({
      secret_name                                 = string
      service_credentials_source_service_role_crn = string
      secret_labels                               = optional(list(string))
      secret_auto_rotation                        = optional(bool)
      secret_auto_rotation_unit                   = optional(string)
      secret_auto_rotation_interval               = optional(number)
      service_credentials_ttl                     = optional(string)
      service_credential_secret_description       = optional(string)

    }))
  }))
| `[]` | no | -| [skip\_cos\_kms\_auth\_policy](#input\_skip\_cos\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the COS instance to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_key_management_service_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | -| [skip\_event\_notifications\_cos\_auth\_policy](#input\_skip\_event\_notifications\_cos\_auth\_policy) | Set to `true` to skip the creation of an IAM authorization policy that permits the Event Notifications instance `Object Writer` and `Reader` access to the given Object Storage bucket. Set to `true` to use an existing policy. | `bool` | `false` | no | -| [skip\_event\_notifications\_kms\_auth\_policy](#input\_skip\_event\_notifications\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the Event Notifications instance to read the encryption key from the KMS instance. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | -| [skip\_event\_notifications\_secrets\_manager\_auth\_policy](#input\_skip\_event\_notifications\_secrets\_manager\_auth\_policy) | Whether an IAM authorization policy is created for Secrets Manager instance to create a service credential secrets for Event Notification.If set to false, the Secrets Manager instance passed by the user is granted the Key Manager access to the Event Notifications instance created by the Deployable Architecture. Set to `true` to use an existing policy. The value of this is ignored if any value for 'existing\_secrets\_manager\_instance\_crn' is not passed. | `bool` | `false` | no | - -### Outputs - -| Name | Description | -|------|-------------| -| [crn](#output\_crn) | Event Notification crn | -| [crn\_list\_object](#output\_crn\_list\_object) | A list of objects containing the CRN of the Event Notifications instance | -| [event\_notification\_instance\_name](#output\_event\_notification\_instance\_name) | Event Notification name | -| [guid](#output\_guid) | Event Notification guid | -| [service\_credential\_secret\_groups](#output\_service\_credential\_secret\_groups) | Service credential secret groups | -| [service\_credential\_secrets](#output\_service\_credential\_secrets) | Service credential secrets | -| [service\_credentials\_json](#output\_service\_credentials\_json) | Service credentials json map | -| [service\_credentials\_object](#output\_service\_credentials\_object) | Service credentials object | - +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). From a2e550809f3b3cffb492c10c7fadc02d9fdfea13 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Wed, 18 Jun 2025 14:26:09 +0000 Subject: [PATCH 04/16] update reference architecture --- reference-architectures/en.svg | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/reference-architectures/en.svg b/reference-architectures/en.svg index dc25a0e5..7278efc2 100644 --- a/reference-architectures/en.svg +++ b/reference-architectures/en.svg @@ -1,4 +1,4 @@ -
IBM Cloud
IBM Cloud
Region
RegionEventNotifications
Existing Resource Group
Existing Resource GroupCloud LogsCloud logs for ActivityTrackerCloud Monitoring
Observability
Observabili...
[Optional]
[Optiona...
                    Cloud Object Storage
Cloud Object...
Bucket
Bucket
Failed Event
Faile...
....
KMS
KMS
Key Ring
Key RingRoot KeyText is not SVG - cannot display +
IBM Cloud
IBM Cloud
Region
RegionEventNotifications
Existing Resource Group
Existing Resource GroupCloud LogsCloud logs for ActivityTrackerCloud Monitoring
Observability
Observabili...
[Optional]
[Optiona...
                    Cloud Object Storage
Cloud Object...
Bucket
BucketFailed Events
....
KMS
KMS
Key Ring
Key RingRoot KeyText is not SVG - cannot display \ No newline at end of file From 11fa85389dc0cf6926a70002436e158e4cedf275 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Wed, 18 Jun 2025 14:30:10 +0000 Subject: [PATCH 05/16] update variable description --- solutions/security-enforced/variables.tf | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/solutions/security-enforced/variables.tf b/solutions/security-enforced/variables.tf index 3cb23512..8b4ddbbc 100644 --- a/solutions/security-enforced/variables.tf +++ b/solutions/security-enforced/variables.tf @@ -16,7 +16,7 @@ variable "ibmcloud_api_key" { variable "region" { type = string - description = "The region in which the Event Notifications resources are provisioned." + description = "The region in which the Event Notifications resources are provisioned. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/region) about how to select different regions for different services." default = "us-south" } @@ -29,15 +29,17 @@ variable "existing_monitoring_crn" { variable "prefix" { type = string - description = "Prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string." + description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: en-0435. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix)." validation { - condition = (var.prefix == null ? true : - alltrue([ - can(regex("^[a-z]{0,1}[-a-z0-9]{0,14}[a-z0-9]{0,1}$", var.prefix)), - length(regexall("^.*--.*", var.prefix)) == 0 - ]) - ) - error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters. Prefixes must end with a lowercase letter or number and be 16 or fewer characters." + condition = var.prefix == null || var.prefix == "" ? true : alltrue([ + can(regex("^[a-z][-a-z0-9]*[a-z0-9]$", var.prefix)), length(regexall("--", var.prefix)) == 0 + ]) + error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')." + } + + validation { + condition = var.prefix == null || var.prefix == "" ? true : length(var.prefix) <= 16 + error_message = "Prefix must not exceed 16 characters." } } From cb13c2f56f3ead1dce11b4ccdcd3cf6bc0d5f954 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Tue, 24 Jun 2025 13:35:27 +0530 Subject: [PATCH 06/16] update readme --- solutions/fully-configurable/README.md | 111 +------------------------ 1 file changed, 1 insertion(+), 110 deletions(-) diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index 63e54448..d9c88c6e 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -1,112 +1,3 @@ # Cloud automation for Event Notification (Fully configurable) -## Prerequisites - -- An existing resource group - -When `existing_en_instance_crn` is not passed, this solution configures the following infrastructure: - -- optionally a KMS key ring -- optionally a KMS key for IBM Event Notifications encryption -- optionally a KMS key for IBM Cloud Object Storage encryption -- optionally an IBM Cloud Object Storage bucket to collect events that fail delivery -- an IBM Event Notifications instance - -When `existing_en_instance_crn` is passed, this solution ignores ALL other inputs and sets the outputs based on the CRN. - -:exclamation: **Important:** This solution is not intended to be called by one or more other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). - -![event-notifications-deployable-architecture](../../reference-architecture/en.svg) - - - -### Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.9.0 | -| [ibm](#requirement\_ibm) | 1.79.2 | -| [time](#requirement\_time) | 0.13.1 | - -### Modules - -| Name | Source | Version | -|------|--------|---------| -| [cos\_buckets](#module\_cos\_buckets) | terraform-ibm-modules/cos/ibm//modules/buckets | 9.0.6 | -| [cos\_kms\_key\_crn\_parser](#module\_cos\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [event\_notifications](#module\_event\_notifications) | ../.. | n/a | -| [existing\_cos\_crn\_parser](#module\_existing\_cos\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_en\_crn\_parser](#module\_existing\_en\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_kms\_crn\_parser](#module\_existing\_kms\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_kms\_key\_crn\_parser](#module\_existing\_kms\_key\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [existing\_sm\_crn\_parser](#module\_existing\_sm\_crn\_parser) | terraform-ibm-modules/common-utilities/ibm//modules/crn-parser | 1.2.0 | -| [kms](#module\_kms) | terraform-ibm-modules/kms-all-inclusive/ibm | 5.1.8 | -| [resource\_group](#module\_resource\_group) | terraform-ibm-modules/resource-group/ibm | 1.2.1 | -| [secrets\_manager\_service\_credentials](#module\_secrets\_manager\_service\_credentials) | terraform-ibm-modules/secrets-manager/ibm//modules/secrets | 2.6.1 | - -### Resources - -| Name | Type | -|------|------| -| [ibm_iam_authorization_policy.cos_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/resources/iam_authorization_policy) | resource | -| [ibm_iam_authorization_policy.en_kms_policy](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/resources/iam_authorization_policy) | resource | -| [ibm_iam_authorization_policy.secrets_manager_key_manager](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/resources/iam_authorization_policy) | resource | -| [time_sleep.wait_for_en_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/0.13.1/docs/resources/sleep) | resource | -| [ibm_resource_instance.existing_en_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/1.79.2/docs/data-sources/resource_instance) | data source | - -### Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [add\_bucket\_name\_suffix](#input\_add\_bucket\_name\_suffix) | Whether to add a randomly generated 4-character suffix to the newly provisioned Object Storage bucket name. Set to `false` if you want full control over bucket naming by using the `cos_bucket_name` variable. | `bool` | `true` | no | -| [cbr\_rules](#input\_cbr\_rules) | The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md) | 
list(object({
    description = string
    account_id  = string
    rule_contexts = list(object({
      attributes = optional(list(object({
        name  = string
        value = string
    }))) }))
    enforcement_mode = string
    operations = optional(list(object({
      api_types = list(object({
        api_type_id = string
      }))
    })))
  }))
| `[]` | no | -| [cos\_bucket\_access\_tags](#input\_cos\_bucket\_access\_tags) | A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, see . | `list(string)` | `[]` | no | -| [cos\_bucket\_class](#input\_cos\_bucket\_class) | The storage class of the newly provisioned Cloud Object Storage bucket. Specify one of the following values for the storage class: `standard`, `vault`, `cold`, `smart` (default), or `onerate_active`. | `string` | `"standard"` | no | -| [cos\_bucket\_name](#input\_cos\_bucket\_name) | The name to use when creating the Object Storage bucket for the storage of failed delivery events. Bucket names are globally unique. If `add_bucket_name_suffix` is set to `true`, a random 4 character string is added to this name to help ensure that the bucket name is unique. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"base-event-notifications-bucket"` | no | -| [cos\_bucket\_region](#input\_cos\_bucket\_region) | The COS bucket region. If `cos_bucket_region` is set to null, then `region` will be used. | `string` | `null` | no | -| [cos\_key\_name](#input\_cos\_key\_name) | The name of the key which will be created for the Event Notifications. Not used if supplying an existing key. Only use if 'enable\_collecting\_failed\_events' is true. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-cos-key"` | no | -| [enable\_collecting\_failed\_events](#input\_enable\_collecting\_failed\_events) | Set to true to enable Cloud Object Storage integration. If true a Cloud Object Storage instance to store failed events in should also be passed using variable `existing_cos_instance_crn`. For more info see . | `bool` | `false` | no | -| [event\_notifications\_access\_tags](#input\_event\_notifications\_access\_tags) | A list of access tags to apply to the Event Notifications instance created by the module. For more information, see . | `list(string)` | `[]` | no | -| [event\_notifications\_instance\_name](#input\_event\_notifications\_instance\_name) | The name of the Event Notifications instance that is created by this solution. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications"` | no | -| [event\_notifications\_key\_name](#input\_event\_notifications\_key\_name) | The name for the key that will be created for the Event Notifications instance. Not used if an existing key is specified. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-key"` | no | -| [event\_notifications\_key\_ring\_name](#input\_event\_notifications\_key\_ring\_name) | The name of the key ring which will be created for the Event Notifications instance. Not used if supplying an existing key. If a `prefix` input variable is specified, it is added to this name in the `-value` format. | `string` | `"event-notifications-key-ring"` | no | -| [event\_notifications\_resource\_tags](#input\_event\_notifications\_resource\_tags) | The list of tags to add to the Event Notifications instance. | `list(string)` | `[]` | no | -| [existing\_cos\_instance\_crn](#input\_existing\_cos\_instance\_crn) | The CRN of an IBM Cloud Object Storage instance. If not supplied, Cloud Object Storage will not be configured. To use, 'enable\_collecting\_failed\_events' must be set to true. | `string` | `null` | no | -| [existing\_event\_notifications\_instance\_crn](#input\_existing\_event\_notifications\_instance\_crn) | The CRN of existing Event Notifications instance. If not supplied, a new instance is created. | `string` | `null` | no | -| [existing\_kms\_instance\_crn](#input\_existing\_kms\_instance\_crn) | The CRN of the KMS instance (Hyper Protect Crypto Services or Key Protect instance). If the KMS instance is in different account you must also provide a value for `ibmcloud_kms_api_key`. To use an existing kms instance you must also provide a value for 'kms\_endpoint\_url' and 'existing\_kms\_root\_key\_crn' should be null. A value should not be passed passing existing EN instance using the `existing_event_notifications_instance_crn` input. | `string` | `null` | no | -| [existing\_kms\_root\_key\_crn](#input\_existing\_kms\_root\_key\_crn) | The key CRN of a root key which will be used to encrypt the data. To use an existing key you must also provide a value for 'kms\_endpoint\_url' and 'existing\_kms\_instance\_crn' should be null. If no value passed, a new key will be created in the instance provided in the `existing_kms_instance_crn` input. | `string` | `null` | no | -| [existing\_monitoring\_crn](#input\_existing\_monitoring\_crn) | The CRN of an IBM Cloud Monitoring instance used to monitor the IBM Cloud Object Storage bucket that is used for storing failed events. Only applicable if failed events are enabled using the `enable_collecting_failed_events` input. If no value passed, metrics are sent to the instance associated to the container's location unless otherwise specified in the Metrics Router service configuration. | `string` | `null` | no | -| [existing\_resource\_group\_name](#input\_existing\_resource\_group\_name) | The name of an existing resource group to provision the resources. | `string` | `"Default"` | no | -| [existing\_secrets\_manager\_endpoint\_type](#input\_existing\_secrets\_manager\_endpoint\_type) | The endpoint type to use if `existing_secrets_manager_instance_crn` is specified. Possible values: public, private. | `string` | `"private"` | no | -| [existing\_secrets\_manager\_instance\_crn](#input\_existing\_secrets\_manager\_instance\_crn) | The CRN of existing secrets manager to use to create service credential secrets for Event Notification instance. | `string` | `null` | no | -| [ibmcloud\_api\_key](#input\_ibmcloud\_api\_key) | The API key to use for IBM Cloud. | `string` | n/a | yes | -| [ibmcloud\_kms\_api\_key](#input\_ibmcloud\_kms\_api\_key) | The IBM Cloud API key that can create a root key and key ring in the key management service (KMS) instance. If not specified, the 'ibmcloud\_api\_key' variable is used. Specify this key if the instance in `existing_kms_instance_crn` is in an account that's different from the Event Notifications instance. Leave this input empty if the same account owns both instances. | `string` | `null` | no | -| [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set to true to enable KMS encryption on Event Notifications instance and Cloud Object Storage bucket. When set to true 'kms\_endpoint\_url' and one of 'existing\_kms\_instance\_crn' or 'existing\_kms\_root\_key\_crn' must be set. | `bool` | `false` | no | -| [kms\_endpoint\_type](#input\_kms\_endpoint\_type) | The type of the endpoint that is used for communicating with the KMS instance. Possible values: `public` or `private` (default). Only used if not supplying an existing root key. | `string` | `"private"` | no | -| [kms\_endpoint\_url](#input\_kms\_endpoint\_url) | The KMS endpoint URL to use when you configure KMS encryption. When set to true, a value must be passed for either `existing_kms_root_key_crn` or `existing_kms_instance_crn` (to create a new key). The Hyper Protect Crypto Services endpoint URL format is `https://api.private..hs-crypto.cloud.ibm.com:` and the Key Protect endpoint URL format is `https://.kms.cloud.ibm.com`. Not required if passing an existing instance using the `existing_event_notifications_instance_crn` input. | `string` | `null` | no | -| [management\_endpoint\_type\_for\_bucket](#input\_management\_endpoint\_type\_for\_bucket) | The type of endpoint for the IBM Terraform provider to use to manage Object Storage buckets. Available values: `public` or `direct`. | `string` | `"direct"` | no | -| [prefix](#input\_prefix) | Prefix to add to all resources created by this solution. To not use any prefix value, you can set this value to `null` or an empty string. | `string` | n/a | yes | -| [provider\_visibility](#input\_provider\_visibility) | Set the visibility value for the IBM terraform provider. Supported values are `public`, `private`, `public-and-private`. [Learn more](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/guides/custom-service-endpoints). | `string` | `"private"` | no | -| [region](#input\_region) | The region in which the Event Notifications resources are provisioned. | `string` | `"us-south"` | no | -| [service\_credential\_names](#input\_service\_credential\_names) | The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more]( | `map(string)` | `{}` | no | -| [service\_credential\_secrets](#input\_service\_credential\_secrets) | Service credential secrets configuration for Event Notification. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets). | 
list(object({
    secret_group_name        = string
    secret_group_description = optional(string)
    existing_secret_group    = optional(bool)
    service_credentials = list(object({
      secret_name                                 = string
      service_credentials_source_service_role_crn = string
      secret_labels                               = optional(list(string))
      secret_auto_rotation                        = optional(bool)
      secret_auto_rotation_unit                   = optional(string)
      secret_auto_rotation_interval               = optional(number)
      service_credentials_ttl                     = optional(string)
      service_credential_secret_description       = optional(string)

    }))
  }))
| `[]` | no | -| [service\_endpoints](#input\_service\_endpoints) | Specify whether you want to enable public, private, or both public and private service endpoints. Possible values: `public`, `private`, `public-and-private` | `string` | `"private"` | no | -| [service\_plan](#input\_service\_plan) | The pricing plan of the Event Notifications instance. Possible values: `Lite`, `Standard` | `string` | `"standard"` | no | -| [skip\_cos\_kms\_auth\_policy](#input\_skip\_cos\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the COS instance to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_key_management_service_instance_crn` variable. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | -| [skip\_event\_notifications\_cos\_auth\_policy](#input\_skip\_event\_notifications\_cos\_auth\_policy) | Set to `true` to skip the creation of an IAM authorization policy that permits the Event Notifications instance `Object Writer` and `Reader` access to the given Object Storage bucket. Set to `true` to use an existing policy. | `bool` | `false` | no | -| [skip\_event\_notifications\_kms\_auth\_policy](#input\_skip\_event\_notifications\_kms\_auth\_policy) | Set to true to skip the creation of an IAM authorization policy that permits the Event Notifications instance to read the encryption key from the KMS instance. If a value is specified for `ibmcloud_kms_api_key`, the policy is created in the KMS account. | `bool` | `false` | no | -| [skip\_event\_notifications\_secrets\_manager\_auth\_policy](#input\_skip\_event\_notifications\_secrets\_manager\_auth\_policy) | Whether an IAM authorization policy is created for Secrets Manager instance to create a service credential secrets for Event Notification.If set to false, the Secrets Manager instance passed by the user is granted the Key Manager access to the Event Notifications instance created by the Deployable Architecture. Set to `true` to use an existing policy. The value of this is ignored if any value for 'existing\_secrets\_manager\_instance\_crn' is not passed. | `bool` | `false` | no | - -### Outputs - -| Name | Description | -|------|-------------| -| [crn](#output\_crn) | Event Notification crn | -| [crn\_list\_object](#output\_crn\_list\_object) | A list of objects containing the CRN of the Event Notifications instance | -| [event\_notification\_instance\_name](#output\_event\_notification\_instance\_name) | Event Notification name | -| [guid](#output\_guid) | Event Notification guid | -| [service\_credential\_secret\_groups](#output\_service\_credential\_secret\_groups) | Service credential secret groups | -| [service\_credential\_secrets](#output\_service\_credential\_secrets) | Service credential secrets | -| [service\_credentials\_json](#output\_service\_credentials\_json) | Service credentials json map | -| [service\_credentials\_object](#output\_service\_credentials\_object) | Service credentials object | - +:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). From da0a5db9fbac9987ee505b8ab0f8d040c6ca260b Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Tue, 24 Jun 2025 13:41:04 +0530 Subject: [PATCH 07/16] add fullstop --- solutions/fully-configurable/variables.tf | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 08f8c031..31fb186b 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -62,7 +62,7 @@ variable "event_notifications_access_tags" { condition = alltrue([ for tag in var.event_notifications_access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128 ]) - error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details" + error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details." } } @@ -72,7 +72,7 @@ variable "event_notifications_access_tags" { variable "service_credential_names" { type = map(string) - description = "The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets" + description = "The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets)." default = {} validation { @@ -89,7 +89,7 @@ variable "event_notifications_instance_name" { variable "service_plan" { type = string - description = "The pricing plan of the Event Notifications instance. Possible values: `Lite`, `Standard`" + description = "The pricing plan of the Event Notifications instance. Possible values: `Lite`, `Standard`." default = "standard" validation { condition = contains(["lite", "standard"], var.service_plan) @@ -99,7 +99,7 @@ variable "service_plan" { variable "service_endpoints" { type = string - description = "Specify whether you want to enable public, private, or both public and private service endpoints. Possible values: `public`, `private`, `public-and-private`" + description = "Specify whether you want to enable public, private, or both public and private service endpoints. Possible values: `public`, `private`, `public-and-private`." default = "private" validation { condition = contains(["public", "private", "public-and-private"], var.service_endpoints) @@ -395,6 +395,6 @@ variable "cbr_rules" { })) }))) })) - description = "The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md)" + description = "The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md)." default = [] } From ed086897523915c3ca0e90f04f527c794bcb7827 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Tue, 24 Jun 2025 14:20:58 +0530 Subject: [PATCH 08/16] add index --- ibm_catalog.json | 2 ++ 1 file changed, 2 insertions(+) diff --git a/ibm_catalog.json b/ibm_catalog.json index db4b093e..7d143d49 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -45,6 +45,7 @@ { "label": "Security-enforced", "name": "security-enforced", + "index": 2, "install_type": "fullstack", "working_directory": "solutions/security-enforced", "compliance": { @@ -234,6 +235,7 @@ { "label": "Fully configurable", "name": "fully-configurable", + "index": 1, "install_type": "fullstack", "working_directory": "solutions/fully-configurable", "compliance": { From 3487bfb1ed2344818410cda7983e2b15c37bafad Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Tue, 24 Jun 2025 14:22:32 +0530 Subject: [PATCH 09/16] update readme --- solutions/fully-configurable/README.md | 2 +- solutions/security-enforced/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/solutions/fully-configurable/README.md b/solutions/fully-configurable/README.md index d9c88c6e..d2a561cc 100644 --- a/solutions/fully-configurable/README.md +++ b/solutions/fully-configurable/README.md @@ -1,3 +1,3 @@ -# Cloud automation for Event Notification (Fully configurable) +# Cloud automation for Event Notifications (Fully configurable) :exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). diff --git a/solutions/security-enforced/README.md b/solutions/security-enforced/README.md index 40e78b59..fda78409 100644 --- a/solutions/security-enforced/README.md +++ b/solutions/security-enforced/README.md @@ -1,3 +1,3 @@ -# Cloud automation for Event Notification (Security Enforced) +# Cloud automation for Event Notifications (Security Enforced) :exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). From e0915872ff98abf41282b1db02895905f3c7a1d8 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Tue, 24 Jun 2025 14:57:48 +0530 Subject: [PATCH 10/16] update readme --- solutions/security-enforced/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/solutions/security-enforced/README.md b/solutions/security-enforced/README.md index fda78409..68675b9c 100644 --- a/solutions/security-enforced/README.md +++ b/solutions/security-enforced/README.md @@ -1,3 +1,3 @@ -# Cloud automation for Event Notifications (Security Enforced) +# Cloud automation for Event Notifications (Security enforced) :exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers). From 6b431689172a0ba6b024006a06239166fb391d50 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Wed, 25 Jun 2025 14:51:43 +0530 Subject: [PATCH 11/16] update feature block --- ibm_catalog.json | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 7d143d49..8fa859ba 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -207,16 +207,8 @@ "architecture": { "features": [ { - "title": "Creates an Event Notifications instance", - "description": "Creates and configures an Event Notifications instance." - }, - { - "title": "Creates key rings and keys", - "description": "Creates key rings and keys in an existing KMS instance." - }, - { - "title": "Collects events that fail delivery", - "description": "Connect an existing Object Storage service instance and bucket. Alternatively, create instances to connect to an Event Notifications instance and collect events that faile delivery." + "title": " ", + "description": "Configured to use IBM secure by default standards that can't be changed." } ], "diagrams": [ @@ -599,16 +591,8 @@ "architecture": { "features": [ { - "title": "Creates an Event Notifications instance", - "description": "Creates and configures an Event Notifications instance." - }, - { - "title": "Creates key rings and keys", - "description": "Creates key rings and keys in an existing KMS instance." - }, - { - "title": "Collects events that fail delivery", - "description": "Connect an existing IBM Cloud Object Storage (COS) service instance and creates a new bucket to collect events that fail delivery." + "title": " ", + "description": "Configured to use IBM secure by default standards, but can be edited to fit your use case." } ], "diagrams": [ From 6f5fd38c0babd3c3280f940f73766624dae65a41 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Thu, 26 Jun 2025 10:23:04 +0000 Subject: [PATCH 12/16] resolve comments --- examples/fscloud/main.tf | 8 ++-- ibm_catalog.json | 46 ++++++++++++++++---- reference-architectures/en.svg | 2 +- solutions/fully-configurable/DA-cbr_rules.md | 6 +-- solutions/fully-configurable/variables.tf | 12 ++--- solutions/security-enforced/variables.tf | 12 ++--- 6 files changed, 57 insertions(+), 29 deletions(-) diff --git a/examples/fscloud/main.tf b/examples/fscloud/main.tf index c40c8bce..f7f89061 100644 --- a/examples/fscloud/main.tf +++ b/examples/fscloud/main.tf @@ -138,8 +138,8 @@ module "event_notification" { rule_contexts = [{ attributes = [ { - "name" : "endpointType", - "value" : "private" + name = "endpointType", + value = "private" }, { name = "networkZoneId" @@ -148,8 +148,8 @@ module "event_notification" { }, { attributes = [ { - "name" : "endpointType", - "value" : "private" + name = "endpointType", + value = "private" }, { name = "networkZoneId" diff --git a/ibm_catalog.json b/ibm_catalog.json index 8fa859ba..4d581632 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -29,18 +29,22 @@ "features": [ { "title": "Creates an IBM Cloud Event Notifications instance", - "description": "For more details on an IBM Cloud Event Notifications instance, [see here](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-about)." + "description": "For more details on an IBM Cloud Event Notifications instance, [Learn more](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-about)." }, { - "title": "Creates Key Rings and Keys to encrypt data", - "description": "For more details on managing encryption using an existing Key Management Services (Key Protect or HPCS) instance, [see here](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-managing-encryption)." + "title": "KMS Encryption", + "description": "Optionally you can enable Key Management Services (Key Protect or HPCS) [encryption](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-managing-encryption) of the event notification instance and Object Storage bucket using either a newly created key or an existing one." }, { - "title": "Collect events that fail delivery", - "description": "Connect an existing IBM Cloud Object Storage (COS) service instance and creates a new bucket to collect events that fail delivery. For more details on collecting failed events [see here](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-cfe-integrations)." + "title": "Object Storage", + "description": "Creates and configures an Object Storage bucket to collect events that fail delivery. You can provide an existing COS Instance or use the [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) for creating a new instance. For more details on collecting failed events, [Learn more](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-cfe-integrations)." + }, + { + "title": "Observability", + "description": "This solution can leverage [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) that supports configuring resources for logging, monitoring and activity tracker event routing (optional)." } ], - "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues please open an issue in that repository [https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/issues](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/issues). Please note this product is not supported via the IBM Cloud Support Center.", + "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues, please open an issue in the repository [here](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/issues). Please note this product is not supported via the IBM Cloud Support Center.", "flavors": [ { "label": "Security-enforced", @@ -182,7 +186,13 @@ "key": "skip_event_notifications_secrets_manager_auth_policy" }, { - "key": "service_credential_secrets" + "key": "service_credential_secrets", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } }, { "key": "service_credential_names" @@ -191,10 +201,23 @@ "key": "existing_event_notifications_instance_crn" }, { - "key": "cbr_rules" + "key": "cbr_rules", + "type": "array", + "custom_config": { + "type": "textarea", + "grouping": "deployment", + "original_grouping": "deployment" + } } ], "iam_permissions": [ + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes": "Viewer access is required in the resource group you want to provision in." + }, { "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", @@ -523,6 +546,13 @@ } ], "iam_permissions": [ + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Viewer" + ], + "service_name": "Resource group only", + "notes": "Viewer access is required in the resource group you want to provision in." + }, { "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", diff --git a/reference-architectures/en.svg b/reference-architectures/en.svg index 7278efc2..fa997b60 100644 --- a/reference-architectures/en.svg +++ b/reference-architectures/en.svg @@ -1,4 +1,4 @@ -
IBM Cloud
IBM Cloud
Region
RegionEventNotifications
Existing Resource Group
Existing Resource GroupCloud LogsCloud logs for ActivityTrackerCloud Monitoring
Observability
Observabili...
[Optional]
[Optiona...
                    Cloud Object Storage
Cloud Object...
Bucket
BucketFailed Events
....
KMS
KMS
Key Ring
Key RingRoot KeyText is not SVG - cannot display \ No newline at end of file +
IBM Cloud
IBM Cloud
Region
RegionEventNotifications
Existing Resource Group
Existing Resource GroupCloud LogsCloud logs for ActivityTrackerCloud Monitoring
Observability
Observabili...
[Optional]
[Optiona...
                    Cloud Object Storage
Cloud Object...
Bucket
BucketFailed Events
....
KMS
KMS
Key Ring
Key RingRoot KeyText is not SVG - cannot display \ No newline at end of file diff --git a/solutions/fully-configurable/DA-cbr_rules.md b/solutions/fully-configurable/DA-cbr_rules.md index d038a377..9d85ca5a 100644 --- a/solutions/fully-configurable/DA-cbr_rules.md +++ b/solutions/fully-configurable/DA-cbr_rules.md @@ -34,15 +34,14 @@ The `cbr_rules` input variable allows you to provide a rule for the target servi ### Example Rule For Context-Based Restrictions Configuration ```hcl -cbr_rules = [ { description = "Event Notifications can be accessed from xyz" account_id = "defc0df06b644a9cabc6e44f55b3880s." rule_contexts= [{ attributes = [ { - "name" : "endpointType", - "value" : "private" + name = "endpointType", + value = "private" }, { name = "networkZoneId" @@ -58,5 +57,4 @@ cbr_rules = [ }] }] } -] ``` diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 31fb186b..351db7d4 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -55,14 +55,14 @@ variable "prefix" { variable "event_notifications_access_tags" { type = list(string) - description = "A list of access tags to apply to the Event Notifications instance created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial." + description = "A list of access tags to apply to the Event Notifications instance created by the module. For more information, [Learn more](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial)." default = [] validation { condition = alltrue([ for tag in var.event_notifications_access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128 ]) - error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details." + error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limit) for more details." } } @@ -239,7 +239,7 @@ variable "ibmcloud_kms_api_key" { variable "enable_collecting_failed_events" { type = bool - description = "Set to true to enable Cloud Object Storage integration. If true a Cloud Object Storage instance to store failed events in should also be passed using variable `existing_cos_instance_crn`. For more info see https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-cfe-integrations." + description = "Set to true to enable Cloud Object Storage integration. If true a Cloud Object Storage instance to store failed events in should also be passed using variable `existing_cos_instance_crn`. For more info, [Learn more](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-cfe-integrations)." default = false validation { condition = var.enable_collecting_failed_events == true ? length(var.existing_cos_instance_crn) > 0 : true @@ -278,14 +278,14 @@ variable "cos_bucket_class" { variable "cos_bucket_access_tags" { type = list(string) - description = "A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial." + description = "A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, [Learn more](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial)." default = [] validation { condition = alltrue([ for tag in var.cos_bucket_access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128 ]) - error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details" + error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details)." } } @@ -365,7 +365,7 @@ variable "service_credential_secrets" { for credential in group.service_credentials : can(regex("^crn:v[0-9]:bluemix(:..*){2}(:.*){3}:(serviceRole|role):..*$", credential.service_credentials_source_service_role_crn)) ]) ]) - error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles" + error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. [Learn more](https://cloud.ibm.com/iam/roles)." } validation { condition = length(var.service_credential_secrets) > 0 ? var.existing_secrets_manager_instance_crn != null : true diff --git a/solutions/security-enforced/variables.tf b/solutions/security-enforced/variables.tf index 8b4ddbbc..5b87e276 100644 --- a/solutions/security-enforced/variables.tf +++ b/solutions/security-enforced/variables.tf @@ -49,12 +49,12 @@ variable "prefix" { variable "service_credential_names" { type = map(string) - description = "The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets" + description = "The mapping of names and roles for service credentials that you want to create for the Event Notifications instance. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-types.md#service-credential-secrets)." default = {} validation { condition = alltrue([for name, role in var.service_credential_names : contains(["Manager", "Writer", "Reader", "Event Source Manager", "Channel Editor", "Event Notification Publisher", "Status Reporter", "Device Manager", "Email Sender", "Custom Email Status Reporter"], role)]) - error_message = "The specified service credential role is not valid. The following values are valid for service credential roles: 'Manager', 'Writer', 'Reader', 'Event Source Manager', 'Channel Editor', 'Event Notification Publisher', 'Status Reporter', 'Device Manager', 'Email Sender', 'Custom Email Status Reporter'" + error_message = "The specified service credential role is not valid. The following values are valid for service credential roles: 'Manager', 'Writer', 'Reader', 'Event Source Manager', 'Channel Editor', 'Event Notification Publisher', 'Status Reporter', 'Device Manager', 'Email Sender', 'Custom Email Status Reporter'." } } @@ -196,14 +196,14 @@ variable "add_bucket_name_suffix" { variable "cos_bucket_access_tags" { type = list(string) - description = "A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, see https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial." + description = "A list of access tags to apply to the Cloud Object Storage bucket created by the module. For more information, [Learn more](https://cloud.ibm.com/docs/account?topic=account-access-tags-tutorial)." default = [] validation { condition = alltrue([ for tag in var.cos_bucket_access_tags : can(regex("[\\w\\-_\\.]+:[\\w\\-_\\.]+", tag)) && length(tag) <= 128 ]) - error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", see https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits for more details" + error_message = "Tags must match the regular expression \"[\\w\\-_\\.]+:[\\w\\-_\\.]+\", [Learn more](https://cloud.ibm.com/docs/account?topic=account-tag&interface=ui#limits) for more details." } } @@ -263,7 +263,7 @@ variable "service_credential_secrets" { for credential in group.service_credentials : can(regex("^crn:v[0-9]:bluemix(:..*){2}(:.*){3}:(serviceRole|role):..*$", credential.service_credentials_source_service_role_crn)) ]) ]) - error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles" + error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. [Learn more](https://cloud.ibm.com/iam/roles)." } } @@ -288,6 +288,6 @@ variable "cbr_rules" { })) }))) })) - description = "The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md)" + description = "The list of context-based restrictions rules to create. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/tree/main/solutions/fully-configurable/DA-cbr_rules.md)." default = [] } From 4e450a355b102c9ac06d8c4719339097326c89b4 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Mon, 30 Jun 2025 13:14:45 +0530 Subject: [PATCH 13/16] update catalog --- ibm_catalog.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 4d581632..dd34c576 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -28,7 +28,7 @@ "provider_name": "IBM", "features": [ { - "title": "Creates an IBM Cloud Event Notifications instance", + "title": "Event Notifications instance", "description": "For more details on an IBM Cloud Event Notifications instance, [Learn more](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-about)." }, { @@ -583,7 +583,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required if COS is chosen for target of Activity Tracker Event routing or Cloud logs data or cloud logs metrics or collecting Event Notifications failed events." + "notes": "[Optional] Required if Cloud Object Storage (COS) is selected as the target for collecting Activity Tracker event routing data, Cloud Logs data, Cloud Logs metrics, or failed Event Notifications." }, { "role_crns": [ @@ -632,7 +632,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-event-notifications/main/reference-architectures/en.svg", "type": "image/svg+xml" }, - "description": "This architecture supports creating and configuring an IBM Cloud Event Notifications instance." + "description": "This architecture supports creating and configuring an IBM Cloud Event Notifications instance.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the storage to collect events that failed delivery . The[Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, the event notification instance and storage bucket can be encrypted using [Key Management Services(KMS)](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-kms-2cad4789-fa90-4886-9c9e-857081c273ee-global) to enhance security.

For logging and monitoring needs, you can enable Observability for your event notification instance. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep%5B%E2%80%A6%5Dbm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for writing the Event notification service credentials to an existing IBM Cloud Secrets Manager instance, ensuring secure management of the credentials." } ] }, From ee2c5614e2db4304cc3ca474ce2d7c18a686e200 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Mon, 30 Jun 2025 17:45:38 +0530 Subject: [PATCH 14/16] update catalog --- ibm_catalog.json | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index dd34c576..972e131f 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -42,6 +42,10 @@ { "title": "Observability", "description": "This solution can leverage [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) that supports configuring resources for logging, monitoring and activity tracker event routing (optional)." + }, + { + "title": "Service credentials", + "description": "Has the ability to create and configure [event notification service credentials](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-service-credentials) for your instance. Optionally choose to configure [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) to create a IBM Cloud Secrets Manager instance to store the service credentials." } ], "support_details": "This product is in the community registry, as such support is handled through the originated repo. If you experience issues, please open an issue in the repository [here](https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/issues). Please note this product is not supported via the IBM Cloud Support Center.", @@ -632,7 +636,7 @@ "url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-event-notifications/main/reference-architectures/en.svg", "type": "image/svg+xml" }, - "description": "This architecture supports creating and configuring an IBM Cloud Event Notifications instance.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the storage to collect events that failed delivery . The[Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, the event notification instance and storage bucket can be encrypted using [Key Management Services(KMS)](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-kms-2cad4789-fa90-4886-9c9e-857081c273ee-global) to enhance security.

For logging and monitoring needs, you can enable Observability for your event notification instance. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep%5B%E2%80%A6%5Dbm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for writing the Event notification service credentials to an existing IBM Cloud Secrets Manager instance, ensuring secure management of the credentials." + "description": "This architecture supports creating and configuring an IBM Cloud Event Notifications instance.

A Cloud Object Storage (COS) instance is required for this topology. Within this instance, an Object Storage bucket will be created, which serves as the storage to collect events that failed delivery . The [Cloud automation for Object Storage](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-cos-68921490-2778-4930-ac6d-bae7be6cd958-global) architecture supports the creation of COS instance. Additionally, the event notification instance and storage bucket can be encrypted using [Key Management Services(KMS)](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-kms-2cad4789-fa90-4886-9c9e-857081c273ee-global) to enhance security.

For logging and monitoring needs, you can enable Observability for your event notification instance. [Cloud automation for Observability](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/deploy-arch-ibm-observability-a3137d28-79e0-479d-8a24-758ebd5a0eab-global) provides advanced monitoring, logging, and operational insights into the performance and health of your deployment.

Secrets Manager Integration can also be enabled using [Cloud automation for Secrets Manager](https://cloud.ibm.com/catalog/7a4d68b4-cf8b-40cd-a3d1-f49aff526eb3/architecture/dep%5B%E2%80%A6%5Dbm-secrets-manager-6d6ebc76-7bbd-42f5-8bc7-78f4fabd5944-global) for writing the Event notification service credentials to an existing IBM Cloud Secrets Manager instance, ensuring secure management of the credentials." } ] }, From 8a0ca93b3feb242685be18feead3da633389e5cd Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Tue, 1 Jul 2025 11:57:08 +0530 Subject: [PATCH 15/16] update catalog --- ibm_catalog.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 972e131f..1c3aba7d 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -22,7 +22,7 @@ "solution" ], "short_description": "Creates and configures an IBM Cloud Event Notifications instance.", - "long_description": "This deployable architecture is used to provision and configure an [IBM Cloud Event Notifications](https://www.ibm.com/products/event-notifications) instance.\n\n\n💡 This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) asset collection, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", + "long_description": "This deployable architecture is used to provision and configure an [IBM Cloud Event Notifications](https://www.ibm.com/products/event-notifications) instance.\n\n\nℹ️ This Terraform-based automation is part of a broader suite of IBM-maintained Infrastructure as Code (IaC) asset collection, each following the naming pattern \"Cloud automation for *servicename*\" and focusing on single IBM Cloud service. These single-service deployable architectures can be used on their own to streamline and automate service deployments through an [IaC approach](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-understanding-projects), or assembled together into a broader [automated IaC stack](https://cloud.ibm.com/docs/secure-enterprise?topic=secure-enterprise-config-stack) to automate the deployment of an end-to-end solution architecture.", "offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-event-notifications/blob/main/solutions/standard/README.md", "offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-event-notifications/main/images/en_icon.svg", "provider_name": "IBM", @@ -587,7 +587,7 @@ "crn:v1:bluemix:public:iam::::role:Editor" ], "service_name": "cloud-object-storage", - "notes": "[Optional] Required if Cloud Object Storage (COS) is selected as the target for collecting Activity Tracker event routing data, Cloud Logs data, Cloud Logs metrics, or failed Event Notifications." + "notes": "[Optional] Required if Cloud Object Storage (COS) is selected as the target for collecting failed Event Notifications." }, { "role_crns": [ From af4ae3050ad55b1cc35dc126da44c1933b5d8f70 Mon Sep 17 00:00:00 2001 From: Md Anam Raihan Date: Mon, 7 Jul 2025 18:25:57 +0530 Subject: [PATCH 16/16] update catalog --- ibm_catalog.json | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/ibm_catalog.json b/ibm_catalog.json index 1c3aba7d..8ff795ee 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -29,7 +29,7 @@ "features": [ { "title": "Event Notifications instance", - "description": "For more details on an IBM Cloud Event Notifications instance, [Learn more](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-about)." + "description": "For more details on an IBM Cloud Event Notifications instance, [see here](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-en-about)." }, { "title": "KMS Encryption", @@ -557,6 +557,13 @@ "service_name": "Resource group only", "notes": "Viewer access is required in the resource group you want to provision in." }, + { + "role_crns": [ + "crn:v1:bluemix:public:iam::::role:Administrator" + ], + "service_name": "All Account Management services", + "notes": "[Optional] Required when setting up foundational IBM Cloud account components such as IAM settings, trusted profiles, access groups, and resource groups." + }, { "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager", @@ -581,6 +588,14 @@ "service_name": "logs", "notes": "[Optional] Required if you are consuming Observability DA which sets up Cloud logs." }, + { + "service_name": "atracker", + "role_crns": [ + "crn:v1:bluemix:public:iam::::serviceRole:Writer", + "crn:v1:bluemix:public:iam::::role:Editor" + ], + "notes": "Required for configuring Activity Tracker event routing to cloud object storage bucket and cloud logs." + }, { "role_crns": [ "crn:v1:bluemix:public:iam::::serviceRole:Manager",