Skip to content

Commit 8e2b936

Browse files
ocofaighocofaigh
authored
feat: Migration to Security and Compliance Center Workload Protection for Cloud Security Posture Management (#251)
BREAKING CHANGE: This solution will no longer provision an instance of the Security and Compliance Center service as it has been deprecated and new instances cannot be provisioned after 16th June 2025.
1 parent 8ead99d commit 8e2b936

File tree

4 files changed

+453
-150
lines changed

4 files changed

+453
-150
lines changed

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ This architecture can help you achieve the following goals:
3131
- Establish trust: The architecture configures the IBM Cloud account to align with the compliance settings that are defined in the [IBM Cloud for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about) framework, and the [AI Security Guardrails 2.0](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ai-security-change-log) profile.
3232
- Ensure observability: The architecture provides observability by deploying services such as IBM Log Analysis, IBM Monitoring, IBM Activity Tracker, and log retention through IBM Cloud Object Storage buckets.
3333
- Implement security: The architecture deploys instances of IBM Key Protect and IBM Secrets Manager.
34-
- Achieve regulatory compliance: The architecture implements CI, CD, and CC pipelines along with IBM Security Compliance Center (SCC) for secure application lifecycle management.
34+
- Achieve regulatory compliance: The architecture implements CI, CD, and CC pipelines along with IBM Security Compliance Center Workload Protection for secure application lifecycle management.
3535

3636
## Before you begin
3737

‎ibm_catalog.json

Lines changed: 215 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@
55
"name": "Retrieval_Augmented_Generation_Pattern",
66
"product_kind": "solution",
77
"tags": [
8+
"solution",
89
"watson",
10+
"security",
911
"banking",
1012
"ibm_created"
1113
],
@@ -25,7 +27,10 @@
2527
"secure",
2628
"secret manager",
2729
"key protect",
28-
"scc"
30+
"security and compliance center workload protection",
31+
"cspm",
32+
"config aggregator",
33+
"app config"
2934
],
3035
"short_description": "Automate RAG deployment with supporting IBM Cloud and watsonx services, embed your enterprise data in generative AI solutions.",
3136
"long_description": "Utilize data from your enterprise to achieve productivity gains in activities related to question/answer conversations, content search, summarization and generation. RAG can be deployed in multiple configurations and is applicable to various industry use cases and solutions.\n\nThis deployable architecture provides a comprehensive foundation for trust, observability, security, and regulatory compliance by configuring and deploying various services and a sample application for a [RAG pattern](https://cloud.ibm.com/docs/pattern-genai-rag?topic=pattern-genai-rag-genai-pattern), including:\n- Configuring IBM Cloud Account with best practices from [IBM Cloud Framework for Financial Services](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-about)\n- Deploying key and secrets management services for storage and management of encryption keys and secrets\n- Deploying controls for continuous compliance\n- Deploying observability services for application and platform logging and monitoring\n- Deploying a suite of watsonx services to provide generative AI RAG capabilities\n- Deploying content databases for storing vector embeddings of the documents and content search/retrieval\n- Deploying a sample application in a variety of run times including CI/CD/CC pipelines for secure application lifecycle management\n\nThe above configured and deployed services enable a secure and trustworthy deployment of generative AI applications on IBM Cloud.\n\nThe configurations are flexible and be changed to meet the needs for several types of RAG patterns depending on the chosen combination of technologies and services.\n\nThe generative AI RAG pattern services include:\n- [watsonx.ai](https://dataplatform.cloud.ibm.com/docs/content/wsj/getting-started/welcome-main.html?context=wx)\n- [watsonx.data](https://cloud.ibm.com/docs/watsonxdata) (with Milvus)\n- [watsonx.governance](https://dataplatform.cloud.ibm.com/docs/content/svc-welcome/aiopenscale.html?context=wx)\n- [watsonx Assistant](https://cloud.ibm.com/docs/watson-assistant?topic=watson-assistant-welcome-new-assistant)\n- [watsonx Orchestrate](https://www.ibm.com/docs/en/watsonx/watson-orchestrate/current)\n- [Watson Discovery](https://cloud.ibm.com/docs/discovery-data)\n- [Elasticsearch](https://cloud.ibm.com/docs/databases-for-elasticsearch) Enterprise and Platinum edition\n\nThe supporting services include:\n- [Secrets Manager](https://cloud.ibm.com/docs/secrets-manager)\n- [Key Protect](https://cloud.ibm.com/docs/key-protect)\n- [Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance)\n- [Event Notifications](https://cloud.ibm.com/docs/event-notifications?topic=event-notifications-getting-started)\n- [Logs](https://cloud.ibm.com/docs/cloud-logs)\n- [Monitoring](https://cloud.ibm.com/docs/monitoring?topic=monitoring-getting-started)\n- [Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage)\n- [Continuous Delivery](https://cloud.ibm.com/docs/ContinuousDelivery) toolchains\n- [Container Registry](https://cloud.ibm.com/docs/Registry)\n\nA [sample RAG application](https://github.com/IBM/gen-ai-rag-watsonx-sample-application) is deployed to [Code Engine](https://cloud.ibm.com/docs/codeengine) or [Red Hat OpenShift](https://cloud.ibm.com/docs/openshift) cluster.\n\nBy leveraging this architecture, you can accelerate your deployment and tailor it to meet your unique business needs and enterprise goals.",
@@ -43,7 +48,7 @@
4348
},
4449
{
4550
"title": "Achieve Regulatory Compliance",
46-
"description": "Ensures regulatory compliance by implementing CI/CD/CC pipelines, along with Security and Compliance Center for continuous compliance."
51+
"description": "Ensures regulatory compliance by implementing CI/CD/CC pipelines, along with Security and Compliance Center Workload Protection for continuous compliance."
4752
},
4853
{
4954
"title": "Ensure Observability",
@@ -104,7 +109,14 @@
104109
"service_name": "kms"
105110
},
106111
{
107-
"service_name": "compliance",
112+
"service_name": "sysdig-secure",
113+
"role_crns": [
114+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
115+
"crn:v1:bluemix:public:iam::::role:Editor"
116+
]
117+
},
118+
{
119+
"service_name": "apprapp",
108120
"role_crns": [
109121
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
110122
"crn:v1:bluemix:public:iam::::role:Editor"
@@ -306,7 +318,7 @@
306318
},
307319
{
308320
"key": "skip_iam_authorization_policy",
309-
"display_name": "Disable Secrets Manager IAM credentials engine auth policy creation?",
321+
"display_name": "disable_secrets_manager_iam_credentials_engine",
310322
"type": "boolean",
311323
"default_value": false,
312324
"description": "Whether to skip the creation of the IAM authorization policies required to enable the Secrets Manager IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service.",
@@ -326,6 +338,69 @@
326338
"description": "Pass a list of regions to create a tenant that is targeted to the Cloud Logs instance created by this solution. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants.",
327339
"required": false
328340
},
341+
{
342+
"key": "app_config_service_plan",
343+
"type": "string",
344+
"default_value": "basic",
345+
"description": "The pricing plan to use for the IBM Cloud App Configuration instance.",
346+
"required": false,
347+
"options": [
348+
{
349+
"displayname": "Basic",
350+
"value": "basic"
351+
},
352+
{
353+
"displayname": "Standard",
354+
"value": "standardv2"
355+
},
356+
{
357+
"displayname": "Enterprise",
358+
"value": "enterprise"
359+
}
360+
]
361+
},
362+
{
363+
"key": "scc_workload_protection_service_plan",
364+
"type": "string",
365+
"default_value": "graduated-tier",
366+
"description": "The pricing plan to use for the IBM Cloud Security and Compliance Center Workload Protection instance.",
367+
"required": false,
368+
"options": [
369+
{
370+
"displayname": "Graduated Tier",
371+
"value": "graduated-tier"
372+
},
373+
{
374+
"displayname": "Free Trial",
375+
"value": "free-trial"
376+
}
377+
]
378+
},
379+
{
380+
"key": "enterprise_id",
381+
"type": "string",
382+
"default_value": "__NULL__",
383+
"description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).",
384+
"required": false
385+
},
386+
{
387+
"key": "enterprise_account_group_ids_to_assign",
388+
"type": "array",
389+
"default_value": [
390+
"all"
391+
],
392+
"description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.",
393+
"required": false
394+
},
395+
{
396+
"key": "enterprise_account_ids_to_assign",
397+
"type": "array",
398+
"default_value": [
399+
"all"
400+
],
401+
"description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.",
402+
"required": false
403+
},
329404
{
330405
"key": "sample_app_git_url",
331406
"type": "string",
@@ -475,7 +550,14 @@
475550
"service_name": "kms"
476551
},
477552
{
478-
"service_name": "compliance",
553+
"service_name": "sysdig-secure",
554+
"role_crns": [
555+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
556+
"crn:v1:bluemix:public:iam::::role:Editor"
557+
]
558+
},
559+
{
560+
"service_name": "apprapp",
479561
"role_crns": [
480562
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
481563
"crn:v1:bluemix:public:iam::::role:Editor"
@@ -690,7 +772,7 @@
690772
},
691773
{
692774
"key": "skip_iam_authorization_policy",
693-
"display_name": "Disable Secrets Manager IAM credentials engine auth policy creation?",
775+
"display_name": "disable_secrets_manager_iam_credentials_engine",
694776
"type": "boolean",
695777
"default_value": false,
696778
"description": "Whether to skip the creation of the IAM authorization policies required to enable the Secrets Manager IAM credentials engine. If set to false, policies will be created that grants the Secrets Manager instance 'Operator' access to the IAM identity service, and 'Groups Service Member Manage' access to the IAM groups service.",
@@ -710,6 +792,133 @@
710792
"description": "Pass a list of regions to create a tenant that is targeted to the Cloud Logs instance created by this solution. To manage platform logs that are generated by IBM Cloud® services in a region of IBM Cloud, you must create a tenant in each region that you operate. Leave the list empty if you don't want to create any tenants.",
711793
"required": false
712794
},
795+
{
796+
"key": "app_config_service_plan",
797+
"type": "string",
798+
"default_value": "basic",
799+
"description": "The pricing plan to use for the IBM Cloud App Configuration instance.",
800+
"required": false,
801+
"options": [
802+
{
803+
"displayname": "Basic",
804+
"value": "basic"
805+
},
806+
{
807+
"displayname": "Standard",
808+
"value": "standardv2"
809+
},
810+
{
811+
"displayname": "Enterprise",
812+
"value": "enterprise"
813+
}
814+
]
815+
},
816+
{
817+
"key": "scc_workload_protection_service_plan",
818+
"type": "string",
819+
"default_value": "graduated-tier",
820+
"description": "The pricing plan to use for the IBM Cloud Security and Compliance Center Workload Protection instance.",
821+
"required": false,
822+
"options": [
823+
{
824+
"displayname": "Graduated Tier",
825+
"value": "graduated-tier"
826+
},
827+
{
828+
"displayname": "Free Trial",
829+
"value": "free-trial"
830+
}
831+
]
832+
},
833+
{
834+
"key": "enterprise_id",
835+
"type": "string",
836+
"default_value": "__NULL__",
837+
"description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).",
838+
"required": false
839+
},
840+
{
841+
"key": "enterprise_account_group_ids_to_assign",
842+
"type": "array",
843+
"default_value": [
844+
"all"
845+
],
846+
"description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.",
847+
"required": false
848+
},
849+
{
850+
"key": "enterprise_account_ids_to_assign",
851+
"type": "array",
852+
"default_value": [
853+
"all"
854+
],
855+
"description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.",
856+
"required": false
857+
},
858+
{
859+
860+
"key": "app_config_service_plan",
861+
"type": "string",
862+
"default_value": "basic",
863+
"description": "The pricing plan to use for the IBM Cloud App Configuration instance.",
864+
"required": false,
865+
"options": [
866+
{
867+
"displayname": "Basic",
868+
"value": "basic"
869+
},
870+
{
871+
"displayname": "Standard",
872+
"value": "standardv2"
873+
},
874+
{
875+
"displayname": "Enterprise",
876+
"value": "enterprise"
877+
}
878+
]
879+
},
880+
{
881+
"key": "scc_workload_protection_service_plan",
882+
"type": "string",
883+
"default_value": "graduated-tier",
884+
"description": "The pricing plan to use for the IBM Cloud Security and Compliance Center Workload Protection instance.",
885+
"required": false,
886+
"options": [
887+
{
888+
"displayname": "Graduated Tier",
889+
"value": "graduated-tier"
890+
},
891+
{
892+
"displayname": "Free Trial",
893+
"value": "free-trial"
894+
}
895+
]
896+
},
897+
{
898+
"key": "enterprise_id",
899+
"type": "string",
900+
"default_value": "__NULL__",
901+
"description": "If the account is an enterprise account and you want to scan sub-accounts for compliance, this value should be set to the enterprise ID (this is different to the account ID).",
902+
"required": false
903+
},
904+
{
905+
"key": "enterprise_account_group_ids_to_assign",
906+
"type": "array",
907+
"default_value": [
908+
"all"
909+
],
910+
"description": "A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned for compliance. Supports passing the string 'all' in the list to assign to all account groups. Only applies if a value is being passed for `enterprise_id`.",
911+
"required": false
912+
},
913+
{
914+
"key": "enterprise_account_ids_to_assign",
915+
"type": "array",
916+
"default_value": [
917+
"all"
918+
],
919+
"description": "A list of enterprise account IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all accounts. Only applies if a value is being passed for `enterprise_id`.",
920+
"required": false
921+
},
713922
{
714923
"key": "sample_app_git_url",
715924
"type": "string",

0 commit comments

Comments
 (0)