Profile for IBM Cloud Framework for Financial Services

This code is a version of the parent root module that includes a default configuration that complies with the relevant controls from the IBM Cloud Framework for Financial Services. See the Solution for IBM Cloud Framework for Financial Services for logic that uses this module. The profile assumes you are deploying into an account that complies with the framework.

The default values in this profile were scanned by IBM Code Risk Analyzer (CRA) for compliance with the IBM Cloud Framework for Financial Services profile that is specified by the IBM Security and Compliance Center. The scan passed for all applicable rules.

Requirements

Name	Version
terraform	>= 1.9.0
ibm	>= 1.79.2, <2.0.0

Modules

Name	Source	Version
event_streams	../../	n/a

Resources

No resources.

Inputs

Name	Description	Type	Default	Required
access_tags	The list of access tags associated with the Event Streams instance.	`list(string)`	`[]`	no
cbr_rules	The list of context-based restriction rules to create.	list(object({ description = string account_id = string rule_contexts = list(object({ attributes = optional(list(object({ name = string value = string }))) })) enforcement_mode = string }))	`[]`	no
create_timeout	The timeout value for creating an Event Streams instance. Specify `3h` for an Enterprise plan instance. Add 1 h for each level of non-default throughput. Add 30 min for each level of non-default storage size.	`string`	`"3h"`	no
delete_timeout	The timeout value for deleting an Event Streams instance.	`string`	`"15m"`	no
es_name	The name of the Event Streams instance.	`string`	n/a	yes
iam_token_only	If set to true, disables Kafka's SASL PLAIN authentication method, only allowing clients to authenticate with SASL OAUTHBEARER via IAM access token. For more information, see: https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-security. Only allowed for enterprise plans.	`bool`	`false`	no
kms_key_crn	The root key CRN of the key management service (Key Protect or Hyper Protect Crypto Services) to use to encrypt the payload data.	`string`	n/a	yes
metrics	Enhanced metrics to activate, as list of strings. Allowed values: 'topic', 'partition', 'consumers'.	`list(string)`	`[]`	no
mirroring	Event Streams mirroring configuration. Required only if creating mirroring instance. For more information on mirroring, see https://cloud.ibm.com/docs/EventStreams?topic=EventStreams-mirroring.	object({ source_crn = string source_alias = string target_alias = string options = optional(object({ topic_name_transform = object({ type = string rename = optional(object({ add_prefix = optional(string) add_suffix = optional(string) remove_prefix = optional(string) remove_suffix = optional(string) })) }) group_id_transform = object({ type = string rename = optional(object({ add_prefix = optional(string) add_suffix = optional(string) remove_prefix = optional(string) remove_suffix = optional(string) })) }) })) })	`null`	no
mirroring_topic_patterns	The list of the topics to set in instance. Required only if creating mirroring instance.	`list(string)`	`null`	no
quotas	Quotas to be applied to the Event Streams instance. Entity may be 'default' to apply to all users, or an IAM ServiceID for a specific user. Rates are bytes/second, with -1 meaning no quota.	list(object({ entity = string producer_byte_rate = optional(number, -1) consumer_byte_rate = optional(number, -1) }))	`[]`	no
region	The region where the Event Streams are created.	`string`	`"us-south"`	no
resource_group_id	The resource group ID where the Event Streams instance is created.	`string`	n/a	yes
schema_global_rule	Schema global compatibility rule. Allowed values are 'NONE', 'FULL', 'FULL_TRANSITIVE', 'FORWARD', 'FORWARD_TRANSITIVE', 'BACKWARD', 'BACKWARD_TRANSITIVE'.	`string`	`null`	no
schemas	The list of schema objects. Include the `schema_id` and the `type` and `name` of the schema in the `schema` object.	list(object( { schema_id = string schema = object({ type = string name = string fields = optional(list(object({ name = string type = string }))) }) } ))	`[]`	no
service_credential_names	The mapping of names and roles for service credentials that you want to create for the Event streams.	`map(string)`	`{}`	no
skip_es_s2s_iam_authorization_policy	Set to true to skip the creation of an Event Streams s2s IAM authorization policy to provision an Event Streams mirroring instance. This is required to read from the source cluster. This policy is required when creating mirroring instance.	`bool`	`false`	no
skip_kms_iam_authorization_policy	Set to true to skip the creation of an IAM authorization policy that permits all Event Streams database instances in the resource group to read the encryption key from the KMS instance. If set to false, pass in a value for the KMS instance in the kms_key_crn variable. In addition, no policy is created if var.kms_encryption_enabled is set to false.	`bool`	`false`	no
tags	The list of tags associated with the Event Streams instance.	`list(string)`	`[]`	no
topics	The list of topics to apply to resources. Only one topic is allowed for Lite plan instances.	list(object( { name = string partitions = number config = map(string) } ))	`[]`	no
update_timeout	The timeout value for updating an Event Streams instance. Specify `1h` for an Enterprise plan instance. Add 1 h for each level of non-default throughput. A 30 min for each level of non-default storage size.	`string`	`"1h"`	no

Outputs

Name	Description
crn	Event Streams instance crn
guid	Event Streams instance guid
id	Event Streams instance id
kafka_broker_version	The Kafka version
kafka_brokers_sasl	(Array of Strings) Kafka brokers use for interacting with Kafka native API
kafka_http_url	The API endpoint to interact with Event Streams REST API
mirroring_config_id	The ID of the mirroring config in CRN format
mirroring_topic_patterns	Mirroring topic patterns
service_credentials_json	Service credentials json map
service_credentials_object	Service credentials object