IBM Cloud Account infrastructure base module

This module is a general base layer module for setting up a newly provisioned account with a default provision of:

• Base Resource Group
• IAM Account Settings
• Trusted Profile + Access Group for Projects
• CBR Rules + Zones

Overview

• terraform-ibm-account-infrastructure-base
• Contributing

Reference architectures

• IBM Cloud Account Infrastructure Base solution

terraform-ibm-account-infrastructure-base

Current limitations:

The module currently does not support setting the following FSCloud requirements:

• Check whether user list visibility restrictions are configured in IAM settings for the account owner
  • Follow these steps as a workaround to set this manually in the UI
• Check whether the Financial Services Validated setting is enabled in account settings
  • Follow these steps as a workaround to set this manually in the UI

Tracking issue with IBM provider -> IBM-Cloud/terraform-provider-ibm#4204

Pre-wired CBR configuration for FS Cloud

This module creates pre-wired rules for CBR from our FS Cloud submodule for CBR, see this README for more details on this configuration.

Usage

module "account_configuration" {
    source  = "terraform-ibm-modules/account-infrastructure-base/ibm"
    version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
    resource_group_name               = "account-base-resource-group"
    trusted_profile_name              = "account-base-trusted-profile"
}

Required IAM access policies

You need the following permissions to run this module.

• Account Management
  • All Account Management services
    • Administrator platform access

Requirements

Name	Version
terraform	>= 1.9.0
ibm	>= 1.79.0, < 2.0.0

Modules

Name	Source	Version
account_settings	terraform-ibm-modules/iam-account-settings/ibm	2.12.0
cbr_fscloud	terraform-ibm-modules/cbr/ibm//modules/fscloud	1.32.0
existing_resource_group	terraform-ibm-modules/resource-group/ibm	1.2.1
resource_group	terraform-ibm-modules/resource-group/ibm	1.2.1
trusted_profile_projects	terraform-ibm-modules/trusted-profile/ibm	2.3.1

Resources

No resources.

Inputs

Name	Description	Type	Default	Required
access_token_expiration	Defines the access token expiration in seconds, has no effect when skip_iam_account_settings is true.	string	"3600"	no
active_session_timeout	Specify how long (seconds) a user is allowed to work continuously in the account, has no effect when skip_iam_account_settings is true.	number	86400	no
allowed_ip_addresses	List of the IP addresses and subnets from which IAM tokens can be created for the account, has no effect when skip_iam_account_settings is true.	list(any)	[]	no
api_creation	When restriction is enabled, only users, including the account owner, assigned the User API key creator role on the IAM Identity Service can create API keys. Allowed values are 'RESTRICTED', 'NOT_RESTRICTED', or 'NOT_SET' (to 'unset' a previous set value), has no effect when skip_iam_account_settings is true.	string	"RESTRICTED"	no
audit_resource_group_name	The name of the audit resource group to create.	string	"audit-rg"	no
cbr_allow_at_to_cos	Whether to enable the rule that allows Activity Tracker to access Object Storage. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_block_storage_to_kms	Whether to enable the rule that allows Block Storage for VPC to access the key management service. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_cos_to_kms	Whether to enable the rule that allows Object Storage to access the key management service. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_event_streams_to_kms	Whether to enable the rule that allows Event Streams to access the key management service. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_icd_to_kms	Whether to enable the rule that allows IBM cloud databases to access the key management service. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_iks_to_is	Whether to enable the rule that allows the Kubernetes Service to access VPC Infrastructure Services. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_is_to_cos	Whether to enable the rule that allows VPC Infrastructure Services to access Object Storage. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_roks_to_kms	Whether to enable the rule that allows Red Hat OpenShift to access the key management service. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_scc_to_cos	Set rule for SCC (Security and Compliance Center) to COS. Default is true if provision_cbr is true.	bool	true	no
cbr_allow_vpcs_to_container_registry	Whether to enable the rule that allows Virtual Private Clouds to access Container Registry. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_vpcs_to_cos	Whether to enable the rule that allows Virtual Private Clouds to access Object Storage. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_vpcs_to_iam_access_management	Whether to enable the rule that allows Virtual Private Clouds to IAM access management. Default is true if provision_cbr is set to true.	bool	true	no
cbr_allow_vpcs_to_iam_groups	Whether to enable the rule that allows Virtual Private Clouds to access IAM groups. Default is true if provision_cbr is set to true.	bool	true	no
cbr_kms_service_targeted_by_prewired_rules	IBM Cloud offers two distinct Key Management Services (KMS): Key Protect and Hyper Protect Crypto Services (HPCS). This variable determines the specific KMS service to which the pre-configured rules are applied. Use the value 'key-protect' to specify the Key Protect service, and 'hs-crypto' for the Hyper Protect Crypto Services (HPCS). Default is ["hs-crypto"] if provision_cbr is set to true.	list(string)	[ "hs-crypto" ]	no
cbr_prefix	String to use as the prefix for all context-based restriction resources, default is account-infra-base if provision_cbr is set to true.	string	"acct-infra-base"	no
cbr_target_service_details	Details of the target service for which a rule is created. The key is the service name.	map(object({ description = optional(string) target_rg = optional(string) instance_id = optional(string) enforcement_mode = string tags = optional(list(string)) region = optional(string) geography = optional(string) global_deny = optional(bool, true) }))	{}	no
devops_resource_group_name	The name of the devops resource group to create.	string	"devops-tools-rg"	no
edge_resource_group_name	The name of the edge resource group to create.	string	"edge-rg"	no
enforce_allowed_ip_addresses	Whether the IP address restriction is enforced. Set the value to false to test the impact of the restriction on your account, once the impact of the restriction has been observed set the value to true.	bool	true	no
inactive_session_timeout	Specify how long (seconds) a user is allowed to stay logged in the account while being inactive/idle, has no effect when skip_iam_account_settings is true.	string	"7200"	no
management_resource_group_name	The name of the management resource group to create.	string	"management-plane-rg"	no
max_sessions_per_identity	Defines the maximum allowed sessions per identity required by the account. Supports any whole number greater than '0', or 'NOT_SET' to unset account setting and use service default, has no effect when skip_iam_account_settings is true.	string	"NOT_SET"	no
mfa	Specify Multi-Factor Authentication method in the account. Supported valid values are 'NONE' (No MFA trait set), 'TOTP' (For all non-federated IBMId users), 'TOTP4ALL' (For all users), 'LEVEL1' (Email based MFA for all users), 'LEVEL2' (TOTP based MFA for all users), 'LEVEL3' (U2F MFA for all users), has no effect when skip_iam_account_settings is true.	string	"TOTP4ALL"	no
observability_resource_group_name	The name of the observability resource group to create.	string	"observability-rg"	no
provision_cbr	Whether to enable the creation of context-based restriction rules and zones in the module. Default is false.	bool	false	no
provision_trusted_profile_projects	Controls whether the Trusted Profile for Projects is provisioned.	bool	true	no
public_access_enabled	Enable/Disable public access group in which resources are open anyone regardless if they are member of your account or not, has no effect when skip_iam_account_settings is true.	bool	false	no
refresh_token_expiration	Defines the refresh token expiration in seconds, has no effect when skip_iam_account_settings is true.	string	"259200"	no
security_resource_group_name	The name of the security resource group to create.	string	"security-rg"	no
serviceid_creation	When restriction is enabled, only users, including the account owner, assigned the Service ID creator role on the IAM Identity Service can create service IDs, has no effect when skip_iam_account_settings is true. Allowed values are 'RESTRICTED', 'NOT_RESTRICTED', or 'NOT_SET' (to 'unset' a previous set value).	string	"RESTRICTED"	no
shell_settings_enabled	Enable global shell settings to all users in the account, has no effect when skip_iam_account_settings is true.	bool	false	no
single_resource_group_name	The name of the single resource group to create. When this variable is provided only one resource group will be created and all other resource group name variables will be ignored.	string	null	no
skip_cloud_shell_calls	Skip Cloud Shell calls in the account, has no effect when skip_iam_account_settings is true.	bool	false	no
skip_iam_account_settings	Set to true to skip the IAM account settings being applied to the account	bool	false	no
trusted_profile_description	Description of the trusted profile.	string	"Trusted Profile for Projects access"	no
trusted_profile_name	Name of the trusted profile, required if provision_trusted_profile_projects is true.	string	null	no
trusted_profile_roles	List of roles given to the trusted profile.	list(string)	[ "Administrator" ]	no
use_existing_audit_resource_group	Set to true to use an existing resource group that has the name provided in audit_resource_group_name.	bool	false	no
use_existing_devops_resource_group	Set to true to use an existing resource group that has the name provided in devops_resource_group_name.	bool	false	no
use_existing_edge_resource_group	Set to true to use an existing resource group that has the name provided in edge_resource_group_name.	bool	false	no
use_existing_management_resource_group	Set to true to use an existing resource group that has the name provided in management_resource_group_name.	bool	false	no
use_existing_observability_resource_group	Set to trueto use an existing resource group that has the name provided in observability_resource_group_name.	bool	false	no
use_existing_security_resource_group	Set to true to use an existing resource group that has the name provided in security_resource_group_name.	bool	false	no
use_existing_single_resource_group	Set to true to use an existing resource group that has the name provided in single_resource_group_name.	bool	false	no
use_existing_workload_resource_group	Set to true to use an existing resource group that has the name provided in workload_resource_group_name.	bool	false	no
user_mfa	Specify Multi-Factor Authentication method for specific users the account. Supported valid values are 'NONE' (No MFA trait set), 'TOTP' (For all non-federated IBMId users), 'TOTP4ALL' (For all users), 'LEVEL1' (Email based MFA for all users), 'LEVEL2' (TOTP based MFA for all users), 'LEVEL3' (U2F MFA for all users). Example of format is available here > https://github.com/terraform-ibm-modules/terraform-ibm-iam-account-settings#usage, has no effect when skip_iam_account_settings is true.	set(object({ iam_id = string mfa = string }))	[]	no
user_mfa_reset	Set to true to delete all user MFA settings configured in the targeted account, and ignoring entries declared in var user_mfa, has no effect when skip_iam_account_settings is true.	bool	false	no
workload_resource_group_name	The name of the workload resource group to create.	string	"workload-rg"	no

Outputs

Name	Description
account_allowed_ip_addresses	Account Settings Allowed IP Addresses
account_allowed_ip_addresses_control_mode	Account Settings Allowed IP Addresses Control Mode
account_allowed_ip_addresses_enforced	Account Settings Allowed IP Addresses Enforced
account_iam_access_token_expiration	Account Settings IAM Access Token Expiration
account_iam_active_session_timeout	Account Settings IAM Active Session Timeout
account_iam_apikey_creation	Account Settings IAM API Key Creation
account_iam_inactive_session_timeout	Account Settings IAM Inactive Session Timeout
account_iam_mfa	Account Settings IAM MFA
account_iam_refresh_token_expiration	Account Settings IAM Refresh Token Expiration
account_iam_serviceid_creation	Account Settings IAM Service ID Creation
account_iam_user_mfa_list	Account Settings IAM User MFA List
account_public_access	Account Settings Public Access
account_shell_settings_status	Account Settings Shell Settings Status
audit_resource_group_id	ID of the Resource Group created for audit-related resources.
audit_resource_group_name	Name of the Resource Group created for audit-related resources.
cbr_map_service_ref_name_zoneid	Map of service reference and zone ids
cbr_map_target_service_rule_ids	Map of target service and rule ids
cbr_map_vpc_zoneid	Map of VPC and zone id
devops_resource_group_id	ID of the Resource Group created devops-related resources.
devops_resource_group_name	Name of the Resource Group created devops-related resources.
edge_resource_group_id	ID of the Resource Group created edge network-related resources.
edge_resource_group_name	Name of the Resource Group created edge network-related resources.
management_resource_group_id	ID of the Resource Group created management-related resources.
management_resource_group_name	Name of the Resource Group created management-related resources.
observability_resource_group_id	ID of the Resource Group created observability-related resources.
observability_resource_group_name	Name of the Resource Group created observability-related resources.
security_resource_group_id	ID of the Resource Group created for security-related resources.
security_resource_group_name	Name of the Resource Group created for security-related resources.
single_resource_group_id	ID of the single Resource Group created by the module.
single_resource_group_name	Name of the single Resource Group created by the module.
trusted_profile_projects	Trusted Profile Projects Profile
trusted_profile_projects_claim_rules	Trusted Profile Projects Profile Claim Rules
trusted_profile_projects_links	Trusted Profile Projects Profile Links
trusted_profile_projects_policies	Trusted Profile Projects Profile Policies
workload_resource_group_id	ID of the Resource Group created workload-related resources.
workload_resource_group_name	Name of the Resource Group created workload-related resources.

Contributing

You can report issues and request features for this module in GitHub issues in the module repo. See Report an issue or request a feature.

To set up your local development environment, see Local development setup in the project documentation.