Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: add depends for cos #74

Merged
merged 7 commits into from
Apr 15, 2024
Merged

fix: add depends for cos #74

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
e0a694b
fix: add depends
Apr 14, 2024
35976ee
fix: add depends
Apr 14, 2024
03da8f5
fix: add depends
Apr 14, 2024
b5a699b
fix: add depends
Apr 14, 2024
e0c0792
fix: update order
Apr 15, 2024
4db3ffb
fix: update order
Apr 15, 2024
affa539
fix: update order
Apr 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,9 @@ No modules.
| [ibm_iam_authorization_policy.scc_wp_s2s_access](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/iam_authorization_policy) | resource |
| [ibm_resource_instance.scc_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/resource_instance) | resource |
| [ibm_scc_instance_settings.scc_instance_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/scc_instance_settings) | resource |
| [ibm_scc_provider_type_instance.scc_provider_type_instance_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/scc_provider_type_instance) | resource |
| [time_sleep.wait_for_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
| [ibm_scc_provider_type_instance.scc_provider_type_instance](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/scc_provider_type_instance) | resource |
| [time_sleep.wait_for_scc_cos_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
| [time_sleep.wait_for_scc_wp_authorization_policy](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |
| [ibm_iam_account_settings.iam_account_settings](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/iam_account_settings) | data source |
| [ibm_scc_provider_types.scc_provider_types](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/scc_provider_types) | data source |

Expand Down
82 changes: 46 additions & 36 deletions main.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,38 +27,22 @@ locals {
provider_type = lookup(local.provider_types_map, "workload-protection", null)
}

resource "ibm_scc_provider_type_instance" "scc_provider_type_instance_instance" {
depends_on = [time_sleep.wait_for_authorization_policy]
count = var.attach_wp_to_scc_instance ? 1 : 0
instance_id = ibm_resource_instance.scc_instance.guid
attributes = { "wp_crn" : var.wp_instance_crn }
name = "workload-protection-instance"
provider_type_id = local.provider_type.id
}

# workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4478
resource "time_sleep" "wait_for_authorization_policy" {
depends_on = [ibm_iam_authorization_policy.scc_wp_s2s_access]

create_duration = "30s"
}

resource "ibm_iam_authorization_policy" "scc_wp_s2s_access" {
count = var.attach_wp_to_scc_instance && !var.skip_scc_wp_auth_policy ? 1 : 0
resource "ibm_iam_authorization_policy" "scc_cos_s2s_access" {
count = var.skip_cos_iam_authorization_policy ? 0 : 1
source_service_name = "compliance"
source_resource_instance_id = ibm_resource_instance.scc_instance.guid
roles = ["Reader"]
roles = ["Writer"]

resource_attributes {
name = "serviceName"
operator = "stringEquals"
value = "sysdig-secure"
value = "cloud-object-storage"
}

resource_attributes {
name = "serviceInstance"
operator = "stringEquals"
value = local.wp_instance_guid
value = local.cos_instance_guid
}

resource_attributes {
Expand All @@ -68,25 +52,42 @@ resource "ibm_iam_authorization_policy" "scc_wp_s2s_access" {
}
}

data "ibm_iam_account_settings" "iam_account_settings" {
# workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4478
resource "time_sleep" "wait_for_scc_cos_authorization_policy" {
depends_on = [ibm_iam_authorization_policy.scc_cos_s2s_access]

create_duration = "30s"
}

resource "ibm_iam_authorization_policy" "scc_cos_s2s_access" {
count = var.skip_cos_iam_authorization_policy ? 0 : 1
# attach a COS bucket and an event notifications instance
resource "ibm_scc_instance_settings" "scc_instance_settings" {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can you leave a code comment above this resource block to explain what its doing (aka attaching a COS bucket and an event notifications instance)

depends_on = [time_sleep.wait_for_scc_cos_authorization_policy]
instance_id = resource.ibm_resource_instance.scc_instance.guid
event_notifications {
instance_crn = var.en_instance_crn
}
object_storage {
instance_crn = var.cos_instance_crn
bucket = var.cos_bucket
}
}

resource "ibm_iam_authorization_policy" "scc_wp_s2s_access" {
count = var.attach_wp_to_scc_instance && !var.skip_scc_wp_auth_policy ? 1 : 0
source_service_name = "compliance"
source_resource_instance_id = ibm_resource_instance.scc_instance.guid
roles = ["Writer"]
roles = ["Reader"]

resource_attributes {
name = "serviceName"
operator = "stringEquals"
value = "cloud-object-storage"
value = "sysdig-secure"
}

resource_attributes {
name = "serviceInstance"
operator = "stringEquals"
value = local.cos_instance_guid
value = local.wp_instance_guid
}

resource_attributes {
Expand All @@ -96,15 +97,24 @@ resource "ibm_iam_authorization_policy" "scc_cos_s2s_access" {
}
}

resource "ibm_scc_instance_settings" "scc_instance_settings" {
instance_id = resource.ibm_resource_instance.scc_instance.guid
event_notifications {
instance_crn = var.en_instance_crn
}
object_storage {
instance_crn = var.cos_instance_crn
bucket = var.cos_bucket
}
# workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4478
resource "time_sleep" "wait_for_scc_wp_authorization_policy" {
depends_on = [ibm_iam_authorization_policy.scc_wp_s2s_access]

create_duration = "30s"
}

# attach an SCC Workload Protection instance
resource "ibm_scc_provider_type_instance" "scc_provider_type_instance" {
depends_on = [time_sleep.wait_for_scc_wp_authorization_policy, ibm_scc_instance_settings.scc_instance_settings]
count = var.attach_wp_to_scc_instance ? 1 : 0
instance_id = ibm_resource_instance.scc_instance.guid
attributes = { "wp_crn" : var.wp_instance_crn }
name = "workload-protection-instance"
provider_type_id = local.provider_type.id
}

data "ibm_iam_account_settings" "iam_account_settings" {
}

locals {
Expand Down
9 changes: 9 additions & 0 deletions moved.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
moved {
from = time_sleep.wait_for_authorization_policy
to = time_sleep.wait_for_scc_wp_authorization_policy
}

moved {
from = ibm_scc_provider_type_instance.scc_provider_type_instance_instance
to = ibm_scc_provider_type_instance.scc_provider_type_instance
}