You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
You can use this module to provision and configure an [IBM Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) instance or bucket.
10
+
You can use this module to provision and configure a [Cloud Object Storage](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-getting-started-cloud-object-storage) instance and bucket.
11
11
12
12
You can configure the following aspects of your instances:
13
-
14
13
-[Bucket encryption](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-tutorial-kp-encrypt-bucket) - based on Key Protect keys
15
14
-[Activity tracking](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-tracking-cos-events) and auditing
@@ -141,13 +181,13 @@ You need the following permissions to run this module.
141
181
| <aname="input_create_hmac_key"></a> [create\_hmac\_key](#input\_create\_hmac\_key)| Set as true to create a new HMAC key for the Cloud Object Storage instance. |`bool`|`true`| no |
142
182
| <aname="input_cross_region_location"></a> [cross\_region\_location](#input\_cross\_region\_location)| Specify the cross-regional bucket location. Supported values are 'us', 'eu', and 'ap'. If you pass a value for this, ensure to set the value of var.region to null. |`string`|`null`| no |
143
183
| <aname="input_existing_cos_instance_id"></a> [existing\_cos\_instance\_id](#input\_existing\_cos\_instance\_id)| The ID of an existing cloud object storage instance. Required if 'var.create\_cos\_instance' is false. |`string`|`null`| no |
144
-
| <aname="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid)| The GUID of the Key Protect or Hyper Protect instance in which the key specified in var.kms\_key\_crn is coming from. Required if var.skip\_iam\_authorization\_policy is false in order to create an IAM Access Policy to allow Key protect or Hyper Protect to access the newly created COS instance. |`string`|`null`| no |
184
+
| <aname="input_existing_kms_instance_guid"></a> [existing\_kms\_instance\_guid](#input\_existing\_kms\_instance\_guid)| The GUID of the Key Protect or Hyper Protect instance in which the key specified in var.kms\_key\_crn is coming from. Required if var.skip\_iam\_authorization\_policy is false in order to create an IAM Access Policy to allow Key Protect or Hyper Protect to access the newly created COS instance. |`string`|`null`| no |
145
185
| <aname="input_expire_days"></a> [expire\_days](#input\_expire\_days)| Specifies the number of days when the expire rule action takes effect. Only used if 'create\_cos\_bucket' is true. |`number`|`365`| no |
146
186
| <aname="input_hmac_key_name"></a> [hmac\_key\_name](#input\_hmac\_key\_name)| The name of the hmac key to be created. |`string`|`"hmac-cos-key"`| no |
147
187
| <aname="input_hmac_key_role"></a> [hmac\_key\_role](#input\_hmac\_key\_role)| The role you want to be associated with your new hmac key. Valid roles are 'Writer', 'Reader', 'Manager', 'Content Reader', 'Object Reader', 'Object Writer'. |`string`|`"Manager"`| no |
148
188
| <aname="input_instance_cbr_rules"></a> [instance\_cbr\_rules](#input\_instance\_cbr\_rules)| (Optional, list) List of CBR rules to create for the instance | <pre>list(object({<br> description = string<br> account_id = string<br> rule_contexts = list(object({<br> attributes = optional(list(object({<br> name = string<br> value = string<br> }))) }))<br> enforcement_mode = string<br> tags = optional(list(object({<br> name = string<br> value = string<br> })), [])<br> operations = optional(list(object({<br> api_types = list(object({<br> api_type_id = string<br> }))<br> })))<br> }))</pre> |`[]`| no |
149
189
| <aname="input_kms_encryption_enabled"></a> [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled)| Set as true to use KMS key encryption to encrypt data in COS bucket (only applicable when var.create\_cos\_bucket is true). |`bool`|`true`| no |
150
-
| <aname="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn)| CRN of the KMS Key to use to encrypt the data in the COS Bucket. Required if var.encryption\_enabled and var.create\_cos\_bucket are true. |`string`|`null`| no |
190
+
| <aname="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn)| CRN of the KMS key to use to encrypt the data in the COS bucket. Required if var.encryption\_enabled and var.create\_cos\_bucket are true. |`string`|`null`| no |
151
191
| <aname="input_management_endpoint_type_for_bucket"></a> [management\_endpoint\_type\_for\_bucket](#input\_management\_endpoint\_type\_for\_bucket)| The type of endpoint for the IBM terraform provider to use to manage the bucket. (public, private, direct) |`string`|`"public"`| no |
152
192
| <aname="input_object_versioning_enabled"></a> [object\_versioning\_enabled](#input\_object\_versioning\_enabled)| Enable object versioning to keep multiple versions of an object in a bucket. Cannot be used with retention rule. Only used if 'create\_cos\_bucket' is true. |`bool`|`false`| no |
153
193
| <aname="input_region"></a> [region](#input\_region)| The region to provision the bucket. If you pass a value for this, do not pass one for var.cross\_region\_location. |`string`|`"us-south"`| no |
@@ -167,11 +207,11 @@ You need the following permissions to run this module.
| <aname="output_bucket_storage_class"></a> [bucket\_storage\_class](#output\_bucket\_storage\_class)| Bucket Storage Class |
172
212
| <aname="output_cos_instance_guid"></a> [cos\_instance\_guid](#output\_cos\_instance\_guid)| The GUID of the Cloud Object Storage Instance where the buckets are created |
173
213
| <aname="output_cos_instance_id"></a> [cos\_instance\_id](#output\_cos\_instance\_id)| The ID of the Cloud Object Storage Instance where the buckets are created |
174
-
| <aname="output_kms_key_crn"></a> [kms\_key\_crn](#output\_kms\_key\_crn)| The CRN of the KMS Key used to encrypt the COS Bucket|
214
+
| <aname="output_kms_key_crn"></a> [kms\_key\_crn](#output\_kms\_key\_crn)| The CRN of the KMS key used to encrypt the COS bucket|
175
215
| <aname="output_resource_group_id"></a> [resource\_group\_id](#output\_resource\_group\_id)| Resource Group ID |
176
216
| <aname="output_s3_endpoint_direct"></a> [s3\_endpoint\_direct](#output\_s3\_endpoint\_direct)| S3 direct endpoint |
# COS Bucket without encryption using an existing COS instance and Key Protect instance + Keys
1
+
# Create Cloud Object Storage instance and a bucket
2
2
3
-
An end-to-end example that will:
4
-
- Create a new resource group (if existing one is not passed in).
5
-
- Create a new Key Protect instance, Key Ring, and Key in the given resource group and region.
6
-
- Using the terraform-ibm-cos module, create a new Cloud Object Storage instance in the given resource group and region (with no buckets).
7
-
- Create an IAM Access Policy to allow Key Protect to access COS instance (outside of the terraform-ibm-cos module).
8
-
- Using the terraform-ibm-cos module, create a COS Bucket without encryption using the existing COS instance, Key Protect instance + Keys created at the start of this example.
3
+
This example creates the following infrastructure:
4
+
- A new resource group, if one is not passed in.
5
+
- A Key Protect instance, key ring, and key in a resource group and region.
6
+
- An IAM access policy to allow Cloud Object Storage to access Key Protect for the encryption key.
7
+
- A Cloud Object Storage instance with no buckets in a resource group and region.
8
+
This example uses the code in the root `terraform-ibm-cos` module.
9
+
- Cloud Object Storage buckets with encryption, versioning and archiving respectively.
0 commit comments