Skip to content

Commit 04c2bc9

Browse files
Aashiq-JAashiq-J
authored
feat: added a new [secrets](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager/tree/main/modules/secrets) terraform module for adding secrets into secrets groups in an existing Secrets Manager instance (#157)
1 parent a858b59 commit 04c2bc9

File tree

15 files changed

+364
-1
lines changed

15 files changed

+364
-1
lines changed

‎README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ This module is used to provision and configure an IBM Cloud [Secrets Manager](ht
1717
* [terraform-ibm-secrets-manager](#terraform-ibm-secrets-manager)
1818
* [Submodules](./modules)
1919
* [fscloud](./modules/fscloud)
20+
* [secrets](./modules/secrets)
2021
* [Examples](./examples)
2122
* [Basic example](./examples/basic)
2223
* [Complete example with BYOK encryption](./examples/complete)
@@ -75,6 +76,7 @@ You need the following permissions to run this module.
7576
| Name | Source | Version |
7677
|------|--------|---------|
7778
| <a name="module_cbr_rule"></a> [cbr\_rule](#module\_cbr\_rule) | terraform-ibm-modules/cbr/ibm//modules/cbr-rule-module | 1.22.2 |
79+
| <a name="module_secrets"></a> [secrets](#module\_secrets) | ./modules/secrets | n/a |
7880

7981
### Resources
8082

@@ -100,6 +102,7 @@ You need the following permissions to run this module.
100102
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of a Key Management Service like Key Protect or Hyper Protect Crypto Services (HPCS) that you want to use for encryption. Only used if `kms_encryption_enabled` is set to true. | `string` | `null` | no |
101103
| <a name="input_region"></a> [region](#input\_region) | The region to provision the Secrets Manager instance to. | `string` | n/a | yes |
102104
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The ID of the resource group to provision the Secrets Manager instance to. | `string` | n/a | yes |
105+
| <a name="input_secrets"></a> [secrets](#input\_secrets) | Secret Manager secrets configurations. | <pre>list(object({<br> secret_group_name = string<br> secret_group_description = optional(string)<br> existing_secret_group = optional(bool, false)<br> secrets = optional(list(object({<br> secret_name = string<br> secret_description = optional(string)<br> secret_type = optional(string)<br> imported_cert_certificate = optional(string)<br> imported_cert_private_key = optional(string)<br> imported_cert_intermediate = optional(string)<br> secret_username = optional(string)<br> secret_labels = optional(list(string), [])<br> secret_payload_password = optional(string, "")<br> secret_auto_rotation = optional(bool, true)<br> secret_auto_rotation_unit = optional(string, "day")<br> secret_auto_rotation_interval = optional(number, 89)<br> service_credentials_ttl = optional(string, "7776000") # 90 days<br> service_credentials_source_service_crn = optional(string)<br> service_credentials_source_service_role = optional(string)<br> })))<br> }))</pre> | `[]` | no |
103106
| <a name="input_secrets_manager_name"></a> [secrets\_manager\_name](#input\_secrets\_manager\_name) | The name to give the Secrets Manager instance. | `string` | n/a | yes |
104107
| <a name="input_skip_en_iam_authorization_policy"></a> [skip\_en\_iam\_authorization\_policy](#input\_skip\_en\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances (scoped to the resource group) an 'Event Source Manager' role to the given Event Notifications instance passed in the `existing_en_instance_crn` input variable. In addition, no policy is created if `enable_event_notification` is set to false. | `bool` | `false` | no |
105108
| <a name="input_skip_kms_iam_authorization_policy"></a> [skip\_kms\_iam\_authorization\_policy](#input\_skip\_kms\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the `existing_kms_instance_guid` variable. In addition, no policy is created if `kms_encryption_enabled` is set to false. | `bool` | `false` | no |
@@ -110,6 +113,8 @@ You need the following permissions to run this module.
110113

111114
| Name | Description |
112115
|------|-------------|
116+
| <a name="output_secret_groups"></a> [secret\_groups](#output\_secret\_groups) | IDs of the created Secret Group |
117+
| <a name="output_secrets"></a> [secrets](#output\_secrets) | List of secret mananger secret config data |
113118
| <a name="output_secrets_manager_crn"></a> [secrets\_manager\_crn](#output\_secrets\_manager\_crn) | CRN of the Secrets Manager instance |
114119
| <a name="output_secrets_manager_guid"></a> [secrets\_manager\_guid](#output\_secrets\_manager\_guid) | GUID of Secrets Manager instance |
115120
| <a name="output_secrets_manager_id"></a> [secrets\_manager\_id](#output\_secrets\_manager\_id) | ID of the Secrets Manager instance |

‎examples/complete/main.tf

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,4 +49,25 @@ module "secrets_manager" {
4949
kms_key_crn = module.key_protect.keys["${var.prefix}-sm.${var.prefix}-sm-key"].crn
5050
enable_event_notification = true
5151
existing_en_instance_crn = module.event_notification.crn
52+
secrets = [
53+
{
54+
secret_group_name = "${var.prefix}-secret-group"
55+
secrets = [{
56+
secret_name = "${var.prefix}-kp-key-crn"
57+
secret_type = "arbitrary"
58+
secret_payload_password = module.key_protect.keys["${var.prefix}-sm.${var.prefix}-sm-key"].crn
59+
}
60+
]
61+
},
62+
{
63+
secret_group_name = "default"
64+
existing_secret_group = true
65+
secrets = [{
66+
secret_name = "${var.prefix}-kp-key-id"
67+
secret_type = "arbitrary"
68+
secret_payload_password = module.key_protect.keys["${var.prefix}-sm.${var.prefix}-sm-key"].key_id
69+
}
70+
]
71+
}
72+
]
5273
}

‎main.tf

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -129,3 +129,15 @@ resource "ibm_sm_en_registration" "sm_en_registration" {
129129
event_notifications_source_name = var.secrets_manager_name
130130
endpoint_type = var.endpoint_type
131131
}
132+
133+
##############################################################################
134+
# Secret Groups/Secrets
135+
##############################################################################
136+
137+
module "secrets" {
138+
source = "./modules/secrets"
139+
existing_sm_instance_guid = local.secrets_manager_guid
140+
existing_sm_instance_region = var.region
141+
secrets = var.secrets
142+
endpoint_type = var.endpoint_type
143+
}

‎modules/fscloud/README.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ No resources.
5454
| <a name="input_kms_key_crn"></a> [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of Hyper Protect Crypto Services (HPCS) that you want to use for encryption. | `string` | n/a | yes |
5555
| <a name="input_region"></a> [region](#input\_region) | The region to provision the Secrets Manager instance to. | `string` | n/a | yes |
5656
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The ID of the resource group to provision the Secrets Manager instance to. | `string` | n/a | yes |
57+
| <a name="input_secrets"></a> [secrets](#input\_secrets) | Secret Manager secrets configurations. | <pre>list(object({<br> secret_group_name = string<br> secret_group_description = optional(string)<br> existing_secret_group = optional(bool, false)<br> secrets = optional(list(object({<br> secret_name = string<br> secret_description = optional(string)<br> secret_type = optional(string)<br> imported_cert_certificate = optional(string)<br> imported_cert_private_key = optional(string)<br> imported_cert_intermediate = optional(string)<br> secret_username = optional(string)<br> secret_labels = optional(list(string), [])<br> secret_payload_password = optional(string, "")<br> secret_auto_rotation = optional(bool, true)<br> secret_auto_rotation_unit = optional(string, "day")<br> secret_auto_rotation_interval = optional(number, 89)<br> service_credentials_ttl = optional(string, "7776000") # 90 days<br> service_credentials_source_service_crn = optional(string)<br> service_credentials_source_service_role = optional(string)<br> })))<br> }))</pre> | `[]` | no |
5758
| <a name="input_secrets_manager_name"></a> [secrets\_manager\_name](#input\_secrets\_manager\_name) | The name to give the Secrets Manager instance. | `string` | n/a | yes |
5859
| <a name="input_service_plan"></a> [service\_plan](#input\_service\_plan) | The Secrets Manager plan to provision. | `string` | `"standard"` | no |
5960
| <a name="input_skip_en_iam_authorization_policy"></a> [skip\_en\_iam\_authorization\_policy](#input\_skip\_en\_iam\_authorization\_policy) | Set to true to skip the creation of an IAM authorization policy that permits all Secrets Manager instances (scoped to the resource group) an 'Event Source Manager' role to the given Event Notifications instance passed in the `existing_en_instance_crn` input variable. In addition, no policy is created if `enable_event_notification` is set to false. | `bool` | `false` | no |
@@ -63,6 +64,8 @@ No resources.
6364

6465
| Name | Description |
6566
|------|-------------|
67+
| <a name="output_secret_groups"></a> [secret\_groups](#output\_secret\_groups) | IDs of the created Secret Group |
68+
| <a name="output_secrets"></a> [secrets](#output\_secrets) | List of secret mananger secret config data |
6669
| <a name="output_secrets_manager_crn"></a> [secrets\_manager\_crn](#output\_secrets\_manager\_crn) | CRN of the Secrets Manager instance |
6770
| <a name="output_secrets_manager_guid"></a> [secrets\_manager\_guid](#output\_secrets\_manager\_guid) | GUID of Secrets Manager instance |
6871
| <a name="output_secrets_manager_id"></a> [secrets\_manager\_id](#output\_secrets\_manager\_id) | ID of the Secrets Manager instance |

‎modules/fscloud/main.tf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,5 @@ module "secrets_manager" {
1414
skip_en_iam_authorization_policy = var.skip_en_iam_authorization_policy
1515
kms_key_crn = var.kms_key_crn
1616
cbr_rules = var.cbr_rules
17+
secrets = var.secrets
1718
}

‎modules/fscloud/outputs.tf

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,13 @@ output "secrets_manager_region" {
2626
value = module.secrets_manager.secrets_manager_region
2727
description = "Region of the Secrets Manager instance"
2828
}
29+
30+
output "secret_groups" {
31+
value = module.secrets_manager.secret_groups
32+
description = "IDs of the created Secret Group"
33+
}
34+
35+
output "secrets" {
36+
value = module.secrets_manager.secrets
37+
description = "List of secret mananger secret config data"
38+
}

‎modules/fscloud/variables.tf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,3 +89,34 @@ variable "cbr_rules" {
8989
default = []
9090
# Validation happens in the rule module
9191
}
92+
93+
##############################################################
94+
# Secrets
95+
##############################################################
96+
97+
variable "secrets" {
98+
type = list(object({
99+
secret_group_name = string
100+
secret_group_description = optional(string)
101+
existing_secret_group = optional(bool, false)
102+
secrets = optional(list(object({
103+
secret_name = string
104+
secret_description = optional(string)
105+
secret_type = optional(string)
106+
imported_cert_certificate = optional(string)
107+
imported_cert_private_key = optional(string)
108+
imported_cert_intermediate = optional(string)
109+
secret_username = optional(string)
110+
secret_labels = optional(list(string), [])
111+
secret_payload_password = optional(string, "")
112+
secret_auto_rotation = optional(bool, true)
113+
secret_auto_rotation_unit = optional(string, "day")
114+
secret_auto_rotation_interval = optional(number, 89)
115+
service_credentials_ttl = optional(string, "7776000") # 90 days
116+
service_credentials_source_service_crn = optional(string)
117+
service_credentials_source_service_role = optional(string)
118+
})))
119+
}))
120+
description = "Secret Manager secrets configurations."
121+
default = []
122+
}

‎modules/secrets/README.md

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Secret Manager secrets module
2+
3+
You can use this submodule to create of secret groups or secrets in an existing Secret Manager instance.
4+
5+
The submodule extends the [secrets](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-secret) and [secret_group](https://github.com/terraform-ibm-modules/terraform-ibm-secrets-manager-secret-group) module by including support for multiple secrets.
6+
7+
### Usage
8+
9+
```hcl
10+
provider "ibm" {
11+
ibmcloud_api_key = "XXXXXXXXXXXXXX" # pragma: allowlist secret
12+
region = "us-south"
13+
}
14+
15+
module "secrets_manager" {
16+
source = "terraform-ibm-modules/secrets-manager/ibm//modules/secrets"
17+
version = "X.X.X" # Replace "X.X.X" with a release version to lock into a specific release
18+
existing_sm_instance_guid = "xxXXxxXXxXxXXXXxxXxxxXXXXxXXXXX"
19+
existing_sm_instance_region = "us-south"
20+
endpoint_type = "public"
21+
secrets = [{
22+
secret_group_name = "secret-group"
23+
secrets = [{
24+
secret_name = "secret1"
25+
secret_type = "arbitrary"
26+
secret_username = "test"
27+
secret_payload_password = "test"
28+
},
29+
{
30+
secret_name = "secret2"
31+
secret_type = "arbitrary"
32+
secret_username = "test"
33+
secret_payload_password = "test"
34+
}
35+
]
36+
}
37+
]
38+
}
39+
```
40+
41+
<!-- BEGINNING OF PRE-COMMIT-TERRAFORM DOCS HOOK -->
42+
### Requirements
43+
44+
| Name | Version |
45+
|------|---------|
46+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.3.0 |
47+
| <a name="requirement_ibm"></a> [ibm](#requirement\_ibm) | >=1.62.0, <2.0.0 |
48+
49+
### Modules
50+
51+
| Name | Source | Version |
52+
|------|--------|---------|
53+
| <a name="module_secret_groups"></a> [secret\_groups](#module\_secret\_groups) | terraform-ibm-modules/secrets-manager-secret-group/ibm | 1.2.2 |
54+
| <a name="module_secrets"></a> [secrets](#module\_secrets) | terraform-ibm-modules/secrets-manager-secret/ibm | 1.3.2 |
55+
56+
### Resources
57+
58+
| Name | Type |
59+
|------|------|
60+
| [ibm_sm_secret_groups.existing_secret_groups](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/data-sources/sm_secret_groups) | data source |
61+
62+
### Inputs
63+
64+
| Name | Description | Type | Default | Required |
65+
|------|-------------|------|---------|:--------:|
66+
| <a name="input_endpoint_type"></a> [endpoint\_type](#input\_endpoint\_type) | The service endpoint type to communicate with the provided secrets manager instance. Possible values are `public` or `private` | `string` | `"public"` | no |
67+
| <a name="input_existing_sm_instance_guid"></a> [existing\_sm\_instance\_guid](#input\_existing\_sm\_instance\_guid) | Instance ID of Secrets Manager instance in which the Secret will be added. | `string` | n/a | yes |
68+
| <a name="input_existing_sm_instance_region"></a> [existing\_sm\_instance\_region](#input\_existing\_sm\_instance\_region) | Region which the Secret Manager is deployed. | `string` | n/a | yes |
69+
| <a name="input_secrets"></a> [secrets](#input\_secrets) | Secret Manager secrets configurations. | <pre>list(object({<br> secret_group_name = string<br> secret_group_description = optional(string)<br> existing_secret_group = optional(bool, false)<br> secrets = optional(list(object({<br> secret_name = string<br> secret_description = optional(string)<br> secret_type = optional(string)<br> imported_cert_certificate = optional(string)<br> imported_cert_private_key = optional(string)<br> imported_cert_intermediate = optional(string)<br> secret_username = optional(string)<br> secret_labels = optional(list(string), [])<br> secret_payload_password = optional(string, "")<br> secret_auto_rotation = optional(bool, true)<br> secret_auto_rotation_unit = optional(string, "day")<br> secret_auto_rotation_interval = optional(number, 89)<br> service_credentials_ttl = optional(string, "7776000") # 90 days<br> service_credentials_source_service_crn = optional(string)<br> service_credentials_source_service_role = optional(string)<br> })))<br> }))</pre> | `[]` | no |
70+
71+
### Outputs
72+
73+
| Name | Description |
74+
|------|-------------|
75+
| <a name="output_secret_groups"></a> [secret\_groups](#output\_secret\_groups) | IDs of the created Secret Group |
76+
| <a name="output_secrets"></a> [secrets](#output\_secrets) | List of secret mananger secret config data |
77+
<!-- END OF PRE-COMMIT-TERRAFORM DOCS HOOK -->

0 commit comments

Comments
 (0)