Skip to content

Commit

Permalink
feat: updated the service_credential_secrets input object schema of…
Browse files Browse the repository at this point in the history 
… the DA to support creating service specific roles<br>* The `service_credentials_source_service_role` attribute has been renamed to `service_credentials_source_service_role_crn` and now requires a full CRN value. For example: `service_credentials_source_service_role_crn = "crn:v1:bluemix:public:iam::::role:Editor"` (#197)

credential source service role
  • Loading branch information
@shemau
shemau authored Jan 31, 2025
1 parent 01637aa commit cd9dd4a
Show file tree
Hide file tree
Showing 4 changed files with 32 additions and 37 deletions.
18 changes: 7 additions & 11 deletions solutions/standard/DA-types.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ In the configuration, specify the secret group name, whether it already exists o
#### Options for service_credentials

- `secret_name`: (required): A unique human-readable name of the secret to create.
- `service_credentials_source_service_role`: (required): The role to give the service credential in the Databases for MySQL service. Acceptable values are `Writer`, `Reader`, `Manager`, and `None`
- `service_credentials_source_service_role_crn`: (required): The CRN of the role to give the service credential in the IBM Cloud Database service. Service credentials role CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role.
- `secret_labels`: (optional, default = `[]`): Labels of the secret to create. Up to 30 labels can be created. Labels can be 2 - 30 characters, including spaces. Special characters that are not permitted include the angled brackets (<>), comma (,), colon (:), ampersand (&), and vertical pipe character (|).
- `secret_auto_rotation`: (optional, default = `true`): Whether to configure automatic rotation of service credential.
- `secret_auto_rotation_unit`: (optional, default = `day`): Specifies the unit of time for rotation of a secret. Acceptable values are `day` or `month`.
Expand All @@ -70,11 +70,11 @@ The following example includes all the configuration options for four service cr
{
"secret_group_name": "sg-1"
"existing_secret_group": true
"service_credentials": [ # pragma: allowlist secret
"service_credentials": [ # pragma: allowlist secret
{
"secret_name": "cred-1"
"service_credentials_source_service_role": "Writer"
"secret_labels": ["test-writer-1", "test-writer-2"]
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor"
"secret_labels": ["test-editor-1", "test-editor-2"]
"secret_auto_rotation": true
"secret_auto_rotation_unit": "day"
"secret_auto_rotation_interval": 89
Expand All @@ -83,20 +83,16 @@ The following example includes all the configuration options for four service cr
},
{
"secret_name": "cred-2"
"service_credentials_source_service_role": "Reader"
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"
}
]
},
{
"secret_group_name": "sg-2"
"service_credentials": [ # pragma: allowlist secret
"service_credentials": [ # pragma: allowlist secret
{
"secret_name": "cred-3"
"service_credentials_source_service_role": "Editor"
},
{
"secret_name": "cred-4"
"service_credentials_source_service_role": "None"
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer"
}
]
}
Expand Down
22 changes: 11 additions & 11 deletions solutions/standard/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -298,16 +298,16 @@ locals {
existing_secret_group = service_credentials.existing_secret_group
secrets = [
for secret in service_credentials.service_credentials : {
secret_name = secret.secret_name
secret_labels = secret.secret_labels
secret_auto_rotation = secret.secret_auto_rotation
secret_auto_rotation_unit = secret.secret_auto_rotation_unit
secret_auto_rotation_interval = secret.secret_auto_rotation_interval
service_credentials_ttl = secret.service_credentials_ttl
service_credential_secret_description = secret.service_credential_secret_description
service_credentials_source_service_role = secret.service_credentials_source_service_role
service_credentials_source_service_crn = module.mysql.crn
secret_type = "service_credentials" #checkov:skip=CKV_SECRET_6
secret_name = secret.secret_name
secret_labels = secret.secret_labels
secret_auto_rotation = secret.secret_auto_rotation
secret_auto_rotation_unit = secret.secret_auto_rotation_unit
secret_auto_rotation_interval = secret.secret_auto_rotation_interval
service_credentials_ttl = secret.service_credentials_ttl
service_credential_secret_description = secret.service_credential_secret_description
service_credentials_source_service_role_crn = secret.service_credentials_source_service_role_crn
service_credentials_source_service_crn = module.mysql.crn
secret_type = "service_credentials" #checkov:skip=CKV_SECRET_6
}
]
}
Expand All @@ -325,7 +325,7 @@ module "secrets_manager_service_credentials" {
count = length(local.service_credential_secrets) > 0 ? 1 : 0
depends_on = [time_sleep.wait_for_mysql_authorization_policy]
source = "terraform-ibm-modules/secrets-manager/ibm//modules/secrets"
version = "1.19.10"
version = "1.22.0"
existing_sm_instance_guid = local.existing_secrets_manager_instance_guid
existing_sm_instance_region = local.existing_secrets_manager_instance_region
endpoint_type = var.existing_secrets_manager_endpoint_type
Expand Down
25 changes: 12 additions & 13 deletions solutions/standard/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -263,30 +263,29 @@ variable "service_credential_secrets" {
secret_group_description = optional(string)
existing_secret_group = optional(bool)
service_credentials = list(object({
secret_name = string
service_credentials_source_service_role = string
secret_labels = optional(list(string))
secret_auto_rotation = optional(bool)
secret_auto_rotation_unit = optional(string)
secret_auto_rotation_interval = optional(number)
service_credentials_ttl = optional(string)
service_credential_secret_description = optional(string)
secret_name = string
service_credentials_source_service_role_crn = string
secret_labels = optional(list(string))
secret_auto_rotation = optional(bool)
secret_auto_rotation_unit = optional(string)
secret_auto_rotation_interval = optional(number)
service_credentials_ttl = optional(string)
service_credential_secret_description = optional(string)

}))
}))
default = []
description = "Service credential secrets configuration for Databases for MySQL. [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-icd-mysql/tree/main/solutions/standard/DA-types.md#service-credential-secrets)."

validation {
# Service roles CRNs can be found at https://cloud.ibm.com/iam/roles, select the IBM Cloud Database and select the role
condition = alltrue([
for group in var.service_credential_secrets : alltrue([
for credential in group.service_credentials : contains(
["Writer", "Reader", "Manager", "None"], credential.service_credentials_source_service_role
)
# crn:v?:bluemix; two non-empty segments; three possibly empty segments; :serviceRole or role: non-empty segment
for credential in group.service_credentials : can(regex("^crn:v[0-9]:bluemix(:..*){2}(:.*){3}:(serviceRole|role):..*$", credential.service_credentials_source_service_role_crn))
])
])
error_message = "service_credentials_source_service_role role must be one of 'Writer', 'Reader', 'Manager', and 'None'."

error_message = "service_credentials_source_service_role_crn must be a serviceRole CRN. See https://cloud.ibm.com/iam/roles"
}
}

Expand Down
4 changes: 2 additions & 2 deletions tests/pr_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -134,11 +134,11 @@ func TestRunStandardSolutionSchematics(t *testing.T) {
"service_credentials": []map[string]string{
{
"secret_name": fmt.Sprintf("%s-cred-reader", options.Prefix),
"service_credentials_source_service_role": "Reader",
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Viewer",
},
{
"secret_name": fmt.Sprintf("%s-cred-writer", options.Prefix),
"service_credentials_source_service_role": "Writer",
"service_credentials_source_service_role_crn": "crn:v1:bluemix:public:iam::::role:Editor",
},
},
},
Expand Down

0 comments on commit cd9dd4a

Please sign in to comment.