From 0934745643f716ff93a869c90b4e22592b91d894 Mon Sep 17 00:00:00 2001 From: Kenneth Cox Date: Fri, 21 Feb 2025 11:16:54 -0600 Subject: [PATCH] Add iam_token_only parameter --- README.md | 1 + main.tf | 14 +++++++++----- modules/fscloud/README.md | 1 + modules/fscloud/main.tf | 1 + modules/fscloud/variables.tf | 6 ++++++ variables.tf | 6 ++++++ 6 files changed, 24 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 9f1580a..52cbe4c 100644 --- a/README.md +++ b/README.md @@ -144,6 +144,7 @@ You need the following permissions to run this module. | [create\_timeout](#input\_create\_timeout) | The timeout value for creating an Event Streams instance. Specify `3h` for an Enterprise plan instance. Add 1 h for each level of non-default throughput. Add 30 min for each level of non-default storage size. | `string` | `"3h"` | no | | [delete\_timeout](#input\_delete\_timeout) | The timeout value for deleting an Event Streams instance. | `string` | `"15m"` | no | | [es\_name](#input\_es\_name) | The name to give the Event Streams instance created by this module. | `string` | n/a | yes | +| [iam\_token\_only](#input\_iam\_token\_only) | If set to true, disables Kafka's SASL PLAIN authentication method, only allowing clients to authenticate with SASL OAUTHBEARER via IAM access token. For more information, see: https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security. Only allowed for enterprise plans. | `bool` | `false` | no | | [kms\_encryption\_enabled](#input\_kms\_encryption\_enabled) | Set this to true to control the encryption keys used to encrypt the data that you store in IBM Cloud® Databases. If set to false, the data is encrypted by using randomly generated keys. For more info on Key Protect integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect. For more info on HPCS integration, see https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs | `bool` | `false` | no | | [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of the key management service (Key Protect or Hyper Protect Crypto Services) to use to encrypt the payload data. [Learn more](https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-managing_encryption) about integrating Hyper Protect Crypto Services with Event Streams. | `string` | `null` | no | | [metrics](#input\_metrics) | Enhanced metrics to activate, as list of strings. Only allowed for enterprise plans. Allowed values: 'topic', 'partition', 'consumers'. | `list(string)` | `[]` | no | diff --git a/main.tf b/main.tf index 2313cfa..cfc04ca 100644 --- a/main.tf +++ b/main.tf @@ -30,11 +30,13 @@ locals { validate_mirroring_topics = var.mirroring == null && var.mirroring_topic_patterns != null ? tobool("When passing values for var.mirroring_topic_patterns, values must also be passed for var.mirroring.") : true # tflint-ignore: terraform_unused_declarations validate_mirroring_config = var.mirroring != null && var.mirroring_topic_patterns == null ? tobool("When passing values for var.mirroring, values must also be passed for var.mirroring_topic_patterns.") : true - parsed_kms_key_crn = var.kms_key_crn != null ? split(":", var.kms_key_crn) : [] - kms_service = length(local.parsed_kms_key_crn) > 0 ? local.parsed_kms_key_crn[4] : null - kms_scope = length(local.parsed_kms_key_crn) > 0 ? local.parsed_kms_key_crn[6] : null - kms_account_id = length(local.parsed_kms_key_crn) > 0 ? split("/", local.kms_scope)[1] : null - kms_key_id = length(local.parsed_kms_key_crn) > 0 ? local.parsed_kms_key_crn[9] : null + # tflint-ignore: terraform_unused_declarations + validate_iam_token_only = var.plan != "enterprise-3nodes-2tb" && var.iam_token_only ? tobool("iam_token_only is only supported for enterprise plan") : true + parsed_kms_key_crn = var.kms_key_crn != null ? split(":", var.kms_key_crn) : [] + kms_service = length(local.parsed_kms_key_crn) > 0 ? local.parsed_kms_key_crn[4] : null + kms_scope = length(local.parsed_kms_key_crn) > 0 ? local.parsed_kms_key_crn[6] : null + kms_account_id = length(local.parsed_kms_key_crn) > 0 ? split("/", local.kms_scope)[1] : null + kms_key_id = length(local.parsed_kms_key_crn) > 0 ? local.parsed_kms_key_crn[9] : null } # workaround for https://github.com/IBM-Cloud/terraform-provider-ibm/issues/4478 @@ -63,6 +65,7 @@ resource "ibm_resource_instance" "es_instance" { service-endpoints = var.service_endpoints throughput = tostring(var.throughput) storage_size = tostring(var.storage_size) + iam_token_only = var.iam_token_only metrics = var.metrics kms_key_crn = var.kms_key_crn mirroring = var.mirroring @@ -72,6 +75,7 @@ resource "ibm_resource_instance" "es_instance" { service-endpoints = var.service_endpoints throughput = tostring(var.throughput) storage_size = tostring(var.storage_size) + iam_token_only = var.iam_token_only } ) } diff --git a/modules/fscloud/README.md b/modules/fscloud/README.md index 2372fe7..c78517c 100644 --- a/modules/fscloud/README.md +++ b/modules/fscloud/README.md @@ -31,6 +31,7 @@ No resources. | [create\_timeout](#input\_create\_timeout) | The timeout value for creating an Event Streams instance. Specify `3h` for an Enterprise plan instance. Add 1 h for each level of non-default throughput. Add 30 min for each level of non-default storage size. | `string` | `"3h"` | no | | [delete\_timeout](#input\_delete\_timeout) | The timeout value for deleting an Event Streams instance. | `string` | `"15m"` | no | | [es\_name](#input\_es\_name) | The name of the Event Streams instance. | `string` | n/a | yes | +| [iam\_token\_only](#input\_iam\_token\_only) | If set to true, disables Kafka's SASL PLAIN authentication method, only allowing clients to authenticate with SASL OAUTHBEARER via IAM access token. For more information, see: https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security. Only allowed for enterprise plans. | `bool` | `false` | no | | [kms\_key\_crn](#input\_kms\_key\_crn) | The root key CRN of the key management service (Key Protect or Hyper Protect Crypto Services) to use to encrypt the payload data. | `string` | n/a | yes | | [metrics](#input\_metrics) | Enhanced metrics to activate, as list of strings. Allowed values: 'topic', 'partition', 'consumers'. | `list(string)` | `[]` | no | | [mirroring](#input\_mirroring) | Event Streams mirroring configuration. Required only if creating mirroring instance. For more information on mirroring, see https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-mirroring. | 
object({
    source_crn   = string
    source_alias = string
    target_alias = string
    options = optional(object({
      topic_name_transform = object({
        type = string
        rename = optional(object({
          add_prefix    = optional(string)
          add_suffix    = optional(string)
          remove_prefix = optional(string)
          remove_suffix = optional(string)
        }))
      })
      group_id_transform = object({
        type = string
        rename = optional(object({
          add_prefix    = optional(string)
          add_suffix    = optional(string)
          remove_prefix = optional(string)
          remove_suffix = optional(string)
        }))
      })
    }))
  })
| `null` | no | diff --git a/modules/fscloud/main.tf b/modules/fscloud/main.tf index 64080a1..77ea999 100644 --- a/modules/fscloud/main.tf +++ b/modules/fscloud/main.tf @@ -20,6 +20,7 @@ module "event_streams" { kms_encryption_enabled = true mirroring_topic_patterns = var.mirroring_topic_patterns mirroring = var.mirroring + iam_token_only = var.iam_token_only create_timeout = var.create_timeout update_timeout = var.update_timeout delete_timeout = var.delete_timeout diff --git a/modules/fscloud/variables.tf b/modules/fscloud/variables.tf index b00221a..93d7449 100644 --- a/modules/fscloud/variables.tf +++ b/modules/fscloud/variables.tf @@ -163,6 +163,12 @@ variable "mirroring" { default = null } +variable "iam_token_only" { + type = bool + description = "If set to true, disables Kafka's SASL PLAIN authentication method, only allowing clients to authenticate with SASL OAUTHBEARER via IAM access token. For more information, see: https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security. Only allowed for enterprise plans." + default = false +} + variable "create_timeout" { type = string description = "The timeout value for creating an Event Streams instance. Specify `3h` for an Enterprise plan instance. Add 1 h for each level of non-default throughput. Add 30 min for each level of non-default storage size." diff --git a/variables.tf b/variables.tf index b838b21..45a5254 100644 --- a/variables.tf +++ b/variables.tf @@ -261,3 +261,9 @@ variable "mirroring" { }) default = null } + +variable "iam_token_only" { + type = bool + description = "If set to true, disables Kafka's SASL PLAIN authentication method, only allowing clients to authenticate with SASL OAUTHBEARER via IAM access token. For more information, see: https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security. Only allowed for enterprise plans." + default = false +}