Skip to content

Commit eb4ae19

Browse files
mukulpalit-ibmmukulpalit-ibm
authored
fix: improve DA user experience (#348)
1 parent 17518a5 commit eb4ae19

File tree

6 files changed

+118
-107
lines changed

6 files changed

+118
-107
lines changed

‎README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,9 @@ Manage > Access (IAM) > Access groups > Access policies.
7474
You need the following permissions to run this module.
7575

7676
- Account Management
77-
- **All Account Management** services
77+
- **All Account Management** services (For creation of resource group)
78+
- `Administrator` platform access
79+
- **All Identity and Access enabled** services (For provisioning of CBR rules)
7880
- `Administrator` platform access
7981

8082
<!-- Below content is automatically populated via pre-commit hook -->

‎ibm_catalog.json

Lines changed: 101 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -21,25 +21,25 @@
2121
"iam"
2222
],
2323
"short_description": "Creates and configures the base layer components of an IBM Cloud account",
24-
"long_description": "This architecture supports creating and configuring the foundational components of an IBM Cloud account. This includes IAM account settings, a trusted profile and associated access groups, and the resource groups in which all resources are provisioned [Learn more...](https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/about.md)\n\nYou can choose from two variations when deploying:\n * **Resource groups only**: Creates a structured set of IBM Cloud resource groups to help organize cloud resources by function [Learn more...](https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/resource-group-configuration.md)\n * **Resource groups with Account Settings**: In addition to resource groups, configures account-level settings for access control, security, and compliance alignment [Learn more...](https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/account-settings-configuration.md)",
24+
"long_description": "This architecture supports creating and configuring the foundational components of an IBM Cloud account. This includes IAM account settings, a trusted profile and associated access groups, and the resource groups in which all resources are provisioned [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/about.md).\n\nYou can choose from two variations when deploying:\n **Resource groups only**: Creates a structured set of IBM Cloud resource groups to help organize cloud resources by function [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/resource-group-configuration.md).\n **Resource groups with Account Settings**: In addition to resource groups, configures account-level settings for access control, security, and compliance alignment [Learn more](https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/account-settings-configuration.md).",
2525
"offering_docs_url": "https://github.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/tree/main/docs/about.md",
2626
"offering_icon_url": "https://raw.githubusercontent.com/terraform-ibm-modules/documentation/main/icons/security_icon.svg",
2727
"provider_name": "IBM",
2828
"features": [
2929
{
30-
"title": "Configures IAM account settings",
31-
"description": "Configures IAM account settings to meet compliance requirements fof the IBM Cloud Framework for Financial Services."
30+
"title": "IAM account settings",
31+
"description": "Configures IAM account settings to meet compliance requirements for the IBM Cloud Framework for Financial Services."
3232
},
3333
{
34-
"title": "Creates access controls",
34+
"title": "Access controls",
3535
"description": "Creates a trusted profile and associated access group to give Projects access to securely deploy solutions in this account."
3636
},
3737
{
38-
"title": "Creates a resource group",
38+
"title": "Resource group",
3939
"description": "Creates resource group where all resources created by this solution are provisioned."
4040
},
4141
{
42-
"title": "Creates CBR rules",
42+
"title": "CBR rules",
4343
"description": "Creates pre-wired CBR rules in a given account following a secure by default approach."
4444
}
4545
],
@@ -48,6 +48,7 @@
4848
{
4949
"label": "Resource groups with account settings",
5050
"name": "resource-groups-with-account-settings",
51+
"index": 1,
5152
"install_type": "fullstack",
5253
"working_directory": "solutions/fully-configurable",
5354
"compliance": {
@@ -65,18 +66,32 @@
6566
"role_crns": [
6667
"crn:v1:bluemix:public:iam::::role:Administrator"
6768
],
68-
"service_name": "iam-identity"
69+
"service_name": "All Account Management services",
70+
"notes": "Administrator access is required for resource group creation and deletion."
71+
},
72+
{
73+
"role_crns": [
74+
"crn:v1:bluemix:public:iam::::role:Administrator"
75+
],
76+
"service_name": "All Identity and Access enabled services",
77+
"notes": "(Optional) Only required if creating context-based restrictions which can be toggled using the `provision_cbr` input."
6978
}
7079
],
7180
"architecture": {
81+
"features": [
82+
{
83+
"title": " ",
84+
"description": "Orchestrates the creation of resource groups, account-level IAM settings, trusted profiles, and context-based restriction (CBR) rules."
85+
}
86+
],
7287
"diagrams": [
7388
{
7489
"diagram": {
7590
"caption": "Account Configuration",
7691
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/main/reference-architectures/base-account-enterprise.svg",
7792
"type": "image/svg+xml"
7893
},
79-
"description": "The Account Configuration architecture provides a standardized approach to setting up cloud account settings as outlined in the IBM Cloud Framework for Financial Services. The architecture includes configurations for IAM settings and access controls that enforce security best practices. You can use this architecture as a base for deploying additional services and resources in multiple types of accounts, such as administrative or workload accounts."
94+
"description": "**IBM Account Configuration** <br/> <br/> <b>Description</b> <br/>The Account Configuration architecture provides a standardized approach to setting up cloud account settings as outlined in the IBM Cloud Framework for Financial Services. The architecture includes configurations for IAM settings and access controls that enforce security best practices. You can use this architecture as a base for deploying additional services and resources in multiple types of accounts, such as administrative or workload accounts."
8095
}
8196
]
8297
},
@@ -90,6 +105,7 @@
90105
},
91106
{
92107
"key": "provider_visibility",
108+
"hidden": true,
93109
"options": [
94110
{
95111
"displayname": "private",
@@ -317,25 +333,33 @@
317333
{
318334
"label": "Resource groups only",
319335
"name": "resource-group-only",
336+
"index": 2,
320337
"install_type": "fullstack",
321338
"working_directory": "solutions/fully-configurable",
322339
"iam_permissions": [
323340
{
324341
"role_crns": [
325-
"crn:v1:bluemix:public:iam::::role:Editor"
342+
"crn:v1:bluemix:public:iam::::role:Administrator"
326343
],
327-
"service_name": "resource-group"
344+
"service_name": "All Account Management services",
345+
"notes": "Administrator access is required for resource group creation and deletion."
328346
}
329347
],
330348
"architecture": {
349+
"features": [
350+
{
351+
"title": " ",
352+
"description": "Orchestrates the creation of resource groups as well as referencing existing resource groups across different functional categories."
353+
}
354+
],
331355
"diagrams": [
332356
{
333357
"diagram": {
334358
"caption": "Resource Groups",
335359
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/main/reference-architectures/rg-only.svg",
336360
"type": "image/svg+xml"
337361
},
338-
"description": "The Account Configuration architecture provides a standardized set of resource groups to prepare for different scenarios. You can use this architecture as a base for deploying additional services and resources in multiple types of accounts, such as administrative or workload accounts."
362+
"description": "**IBM Account Configuration** <br/> <br/> <b>Description</b> <br/>The Account Configuration architecture provides a standardized set of resource groups to prepare for different scenarios. You can use this architecture as a base for deploying additional services and resources in multiple types of accounts, such as administrative or workload accounts."
339363
}
340364
]
341365
},
@@ -347,71 +371,6 @@
347371
"key": "prefix",
348372
"required": true
349373
},
350-
{
351-
"key": "provider_visibility",
352-
"options": [
353-
{
354-
"displayname": "private",
355-
"value": "private"
356-
},
357-
{
358-
"displayname": "public",
359-
"value": "public"
360-
},
361-
{
362-
"displayname": "public-and-private",
363-
"value": "public-and-private"
364-
}
365-
]
366-
},
367-
{
368-
"key": "single_resource_group_name"
369-
},
370-
{
371-
"key": "use_existing_single_resource_group"
372-
},
373-
{
374-
"key": "audit_resource_group_name"
375-
},
376-
{
377-
"key": "use_existing_audit_resource_group"
378-
},
379-
{
380-
"key": "devops_resource_group_name"
381-
},
382-
{
383-
"key": "use_existing_devops_resource_group"
384-
},
385-
{
386-
"key": "edge_resource_group_name"
387-
},
388-
{
389-
"key": "use_existing_edge_resource_group"
390-
},
391-
{
392-
"key": "management_resource_group_name"
393-
},
394-
{
395-
"key": "use_existing_management_resource_group"
396-
},
397-
{
398-
"key": "observability_resource_group_name"
399-
},
400-
{
401-
"key": "use_existing_observability_resource_group"
402-
},
403-
{
404-
"key": "security_resource_group_name"
405-
},
406-
{
407-
"key": "use_existing_security_resource_group"
408-
},
409-
{
410-
"key": "workload_resource_group_name"
411-
},
412-
{
413-
"key": "use_existing_workload_resource_group"
414-
},
415374
{
416375
"key": "skip_iam_account_settings",
417376
"default_value": true,
@@ -506,6 +465,72 @@
506465
{
507466
"key": "cbr_kms_service_targeted_by_prewired_rules",
508467
"hidden": true
468+
},
469+
{
470+
"key": "single_resource_group_name"
471+
},
472+
{
473+
"key": "use_existing_single_resource_group"
474+
},
475+
{
476+
"key": "audit_resource_group_name"
477+
},
478+
{
479+
"key": "use_existing_audit_resource_group"
480+
},
481+
{
482+
"key": "devops_resource_group_name"
483+
},
484+
{
485+
"key": "use_existing_devops_resource_group"
486+
},
487+
{
488+
"key": "edge_resource_group_name"
489+
},
490+
{
491+
"key": "use_existing_edge_resource_group"
492+
},
493+
{
494+
"key": "management_resource_group_name"
495+
},
496+
{
497+
"key": "use_existing_management_resource_group"
498+
},
499+
{
500+
"key": "observability_resource_group_name"
501+
},
502+
{
503+
"key": "use_existing_observability_resource_group"
504+
},
505+
{
506+
"key": "security_resource_group_name"
507+
},
508+
{
509+
"key": "use_existing_security_resource_group"
510+
},
511+
{
512+
"key": "workload_resource_group_name"
513+
},
514+
{
515+
"key": "use_existing_workload_resource_group"
516+
},
517+
{
518+
"key": "provider_visibility",
519+
"hidden": true,
520+
"options": [
521+
{
522+
"displayname": "private",
523+
"value": "private"
524+
},
525+
{
526+
"displayname": "public",
527+
"value": "public"
528+
},
529+
{
530+
"displayname": "public-and-private",
531+
"value": "public-and-private"
532+
}
533+
]
509534
}
510535
]
511536
}

‎reference-architectures/base-account-enterprise.svg

Lines changed: 1 addition & 1 deletion
Loading

‎reference-architectures/rg-only.svg

Lines changed: 1 addition & 1 deletion
Loading

‎solutions/fully-configurable/README.md

Lines changed: 2 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,3 @@
1-
# IBM Cloud Account Infrastructure Base solution
1+
# Cloud Automation for Account Configuration
22

3-
An end-to-end deployable architecture solution that provisions the following infrastructure:
4-
5-
- A set of resource groups for separation of resources
6-
- A default set of account settings that are compliant with the IBM Cloud for Financial Services framework
7-
- A trusted profile to give access for IBM Cloud Projects to deploy solutions securely in this account
8-
- A set of context-based restriction rules and zones that are compliant with IBM Cloud Framework for Financial Services.
9-
10-
![account-infrastructure-base](https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-account-infrastructure-base/main/reference-architectures/base-account-enterprise.svg)
11-
12-
## Limitations
13-
14-
The solution does not support configuring the following settings that are required for compliance with IBM Cloud for Financial Services:
15-
16-
- The user list visibility IAM setting. An account owner can enable this restriction in the IBM Cloud console by following these [steps](https://cloud.ibm.com/docs/account?topic=account-iam-user-setting).
17-
- The Financial Services Validated setting. An account owner can enable the account to be designated as Financial Services Validated. IBM Cloud for Financial Services Validated designates that an IBM Cloud service or ecosystem partner service has evidenced compliance to the controls of the IBM Cloud Framework for Financial Services and can be used to build solutions that might themselves be validated.
18-
19-
For more information, see [Enabling your account to use Financial Services Validated products](https://cloud.ibm.com/docs/account?topic=account-enabling-fs-validated).
20-
21-
Tracking issue with IBM provider -> https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4204
3+
:exclamation: **Important:** This solution is not intended to be called by other modules because it contains a provider configuration and is not compatible with the `for_each`, `count`, and `depends_on` arguments. For more information, see [Providers Within Modules](https://developer.hashicorp.com/terraform/language/modules/develop/providers).

‎solutions/fully-configurable/variables.tf

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -21,20 +21,22 @@ variable "provider_visibility" {
2121

2222
variable "prefix" {
2323
type = string
24-
description = "The prefix to add to all resources that this solution creates. To not use any prefix value, you can set this value to `null` or an empty string."
2524
nullable = true
25+
description = "The prefix to be added to all resources created by this solution. To skip using a prefix, set this value to null or an empty string. The prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and can not contain consecutive hyphens ('--'). Example: prod-us-south. [Learn more](https://terraform-ibm-modules.github.io/documentation/#/prefix.md)."
2626

27-
# prefix restriction due to limitations when using multiple DAs in stacks
28-
# this value was determined based on the lowest prefix restriction located here:
29-
# https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone/blob/main/patterns/roks/variables.tf#L11
3027
validation {
31-
condition = (var.prefix == null ? true :
28+
# - null and empty string is allowed
29+
# - Must not contain consecutive hyphens (--): length(regexall("--", var.prefix)) == 0
30+
# - Starts with a lowercase letter: [a-z]
31+
# - Contains only lowercase letters (a–z), digits (0–9), and hyphens (-) and must not exceed 16 characters in length: [a-z0-9-]{0,14}
32+
# - Must not end with a hyphen (-): [a-z0-9]
33+
condition = (var.prefix == null || var.prefix == "" ? true :
3234
alltrue([
33-
can(regex("^[a-z]{0,1}[-a-z0-9]{0,11}[a-z0-9]{0,1}$", var.prefix)),
34-
length(regexall("^.*--.*", var.prefix)) == 0
35+
can(regex("^[a-z][-a-z0-9]{0,14}[a-z0-9]$", var.prefix)),
36+
length(regexall("--", var.prefix)) == 0
3537
])
3638
)
37-
error_message = "Prefix must begin with a lowercase letter, contain only lowercase letters, numbers, and - characters, and cannot have double hyphens (--). Prefixes must end with a lowercase letter or number and be 13 or fewer characters."
39+
error_message = "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It should not exceed 16 characters, must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--')."
3840
}
3941
}
4042

0 commit comments

Comments
 (0)