You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -104,6 +109,13 @@ For more information on access and permissions, see <https://cloud.ibm.com/docs/
104
109
| <aname="input_app_config_service_endpoints"></a> [app\_config\_service\_endpoints](#input\_app\_config\_service\_endpoints)| Service Endpoints for the App Configuration service instance, valid endpoints are public or public-and-private. |`string`|`"public-and-private"`| no |
105
110
| <aname="input_app_config_tags"></a> [app\_config\_tags](#input\_app\_config\_tags)| Optional list of tags to be added to the App Config instance. |`list(string)`|`[]`| no |
106
111
| <aname="input_cbr_rules"></a> [cbr\_rules](#input\_cbr\_rules)| The list of context-based restriction rules to create. | <pre>list(object({<br/> description = string<br/> account_id = string<br/> tags = optional(list(object({<br/> name = string<br/> value = string<br/> })), [])<br/> rule_contexts = list(object({<br/> attributes = optional(list(object({<br/> name = string<br/> value = string<br/> }))) }))<br/> enforcement_mode = string<br/> }))</pre> |`[]`| no |
112
+
| <aname="input_config_aggregator_enterprise_account_group_ids_to_assign"></a> [config\_aggregator\_enterprise\_account\_group\_ids\_to\_assign](#input\_config\_aggregator\_enterprise\_account\_group\_ids\_to\_assign)| A list of enterprise account group IDs to assign the trusted profile template to in order for the accounts to be scanned. Supports passing the string 'all' in the list to assign to all account groups. Only applies if `enable_config_aggregator` is true and a value is being passed for `config_aggregator_enterprise_id`. |`list(string)`| <pre>[<br/> "all"<br/>]</pre> | no |
113
+
| <aname="input_config_aggregator_enterprise_id"></a> [config\_aggregator\_enterprise\_id](#input\_config\_aggregator\_enterprise\_id)| If the account is an enterprise account, this value should be set to the enterprise ID (NOTE: This is different to the account ID). |`string`|`null`| no |
114
+
| <aname="input_config_aggregator_enterprise_trusted_profile_name"></a> [config\_aggregator\_enterprise\_trusted\_profile\_name](#input\_config\_aggregator\_enterprise\_trusted\_profile\_name)| The name to give the enterprise viewer trusted profile with that will be created if `enable_config_aggregator` is set to `true` and a value is passed for `config_aggregator_enterprise_id`. |`string`|`"config-aggregator-enterprise-trusted-profile"`| no |
115
+
| <aname="input_config_aggregator_enterprise_trusted_profile_template_name"></a> [config\_aggregator\_enterprise\_trusted\_profile\_template\_name](#input\_config\_aggregator\_enterprise\_trusted\_profile\_template\_name)| The name to give the trusted profile template that will be created if `enable_config_aggregator` is set to `true` and a value is passed for `config_aggregator_enterprise_id`. |`string`|`"config-aggregator-trusted-profile-template"`| no |
116
+
| <aname="input_config_aggregator_resource_collection_regions"></a> [config\_aggregator\_resource\_collection\_regions](#input\_config\_aggregator\_resource\_collection\_regions)| From which region do you want to collect configuration data? Only applies if `enable_config_aggregator` is set to true. |`list(string)`| <pre>[<br/> "all"<br/>]</pre> | no |
117
+
| <aname="input_config_aggregator_trusted_profile_name"></a> [config\_aggregator\_trusted\_profile\_name](#input\_config\_aggregator\_trusted\_profile\_name)| The name to give the trusted profile that will be created if `enable_config_aggregator` is set to `true`. |`string`|`"config-aggregator-trusted-profile"`| no |
118
+
| <aname="input_enable_config_aggregator"></a> [enable\_config\_aggregator](#input\_enable\_config\_aggregator)| Set to true to enable configuration aggregator. By setting to true a trusted profile will be created with the required access to record configuration data from all resources across regions in your account. [Learn more](https://cloud.ibm.com/docs/app-configuration?topic=app-configuration-ac-configuration-aggregator). |`bool`|`false`| no |
107
119
| <aname="input_region"></a> [region](#input\_region)| The region to provision the App Configuration service, valid regions are us-south, us-east, eu-gb, and au-syd. |`string`|`"us-south"`| no |
108
120
| <aname="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id)| The resource group ID where resources will be provisioned. |`string`| n/a | yes |
109
121
@@ -116,6 +128,9 @@ For more information on access and permissions, see <https://cloud.ibm.com/docs/
116
128
| <aname="output_app_config_crn"></a> [app\_config\_crn](#output\_app\_config\_crn)| CRN of the App Configuration instance |
117
129
| <aname="output_app_config_guid"></a> [app\_config\_guid](#output\_app\_config\_guid)| GUID of the App Configuration instance |
118
130
| <aname="output_app_config_id"></a> [app\_config\_id](#output\_app\_config\_id)| ID of the App Configuration instance |
131
+
| <aname="output_config_aggregator_enterprise_trusted_profile_id"></a> [config\_aggregator\_enterprise\_trusted\_profile\_id](#output\_config\_aggregator\_enterprise\_trusted\_profile\_id)| ID of the config aggregator trusted profile for enterprise access |
132
+
| <aname="output_config_aggregator_enterprise_trusted_profile_template_id"></a> [config\_aggregator\_enterprise\_trusted\_profile\_template\_id](#output\_config\_aggregator\_enterprise\_trusted\_profile\_template\_id)| ID of the config aggregator trusted profile enterprise template ID |
133
+
| <aname="output_config_aggregator_trusted_profile_id"></a> [config\_aggregator\_trusted\_profile\_id](#output\_config\_aggregator\_trusted\_profile\_id)| ID of the config aggregator trusted profile |
119
134
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
120
135
121
136
<!-- Leave this section as is so that your module has a link to local development environment set up steps for contributors to follow -->
# More info about this file at https://github.com/terraform-ibm-modules/common-pipeline-assets/blob/main/.github/workflows/terraform-test-pipeline.md#cra-config-yaml
2
2
version: "v1"
3
3
CRA_TARGETS:
4
-
- CRA_TARGET: "examples/complete"# Target directory for CRA scan. If not provided, the CRA Scan will not be run.
4
+
- CRA_TARGET: "examples/advanced"# Target directory for CRA scan. If not provided, the CRA Scan will not be run.
5
5
CRA_IGNORE_RULES_FILE: "cra-tf-validate-ignore-rules.json"# CRA Ignore file to use. If not provided, it checks the repo root directory for `cra-tf-validate-ignore-rules.json`
6
6
PROFILE_ID: "fe96bd4d-9b37-40f2-b39f-a62760e326a3"# SCC profile ID (currently set to 'IBM Cloud Framework for Financial Services' '1.7.0' profile).
trusted_profile_description="Trusted Profile for App Configuration instance ${ibm_resource_instance.app_config.guid} with required access for configuration aggregator"
trusted_profile_description="Trusted Profile for App Configuration instance ${ibm_resource_instance.app_config.guid} with required access for configuration aggregator for enterprise accounts"
96
+
97
+
trusted_profile_identity={
98
+
identifier = ibm_resource_instance.app_config.crn
99
+
identity_type ="crn"
100
+
}
101
+
102
+
trusted_profile_policies=[
103
+
{
104
+
roles = ["Viewer", local.custom_role]
105
+
resource_attributes = [{
106
+
name ="service_group_id"
107
+
value ="IAM"
108
+
operator ="stringEquals"
109
+
}]
110
+
description ="IAM access with custom role"
111
+
},
112
+
{
113
+
roles = ["Viewer"]
114
+
resources = [{
115
+
service ="enterprise"
116
+
}]
117
+
description ="Enterprise viewer and template reader access"
118
+
}
119
+
]
120
+
121
+
trusted_profile_links=[{
122
+
cr_type ="VSI"
123
+
links = [{
124
+
crn = ibm_resource_instance.app_config.crn
125
+
}]
126
+
}]
127
+
}
128
+
129
+
# If enterprise account, create trusted profile template
template_description="Trusted Profile template for App Configuration instance ${ibm_resource_instance.app_config.guid} with required access for configuration aggregator"
profile_description="Trusted Profile for App Configuration instance ${ibm_resource_instance.app_config.guid} with required access for configuration aggregator"
0 commit comments