IBM-Cloud / terraform-provider-ibm

https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs
Mozilla Public License 2.0
336 stars 645 forks source link

update(cloud-databases): Make Service Endpoints Required and send warning when public endpoints are in use #5402

Closed omaraibrahim closed 2 weeks ago

omaraibrahim commented 1 month ago

Community Note

Relates OR Closes #0000

Example of Warning in terraform plan When Public Endpoints are in Use:

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # ibm_database.elasticsearch will be updated in-place
  ~ resource "ibm_database" "elasticsearch" {
        id                      = "crn:v1:bluemix:public:databases-for-elasticsearch:us-south:a/40ddc34a953a8c02f10987b59085b60e:678da497-8106-46ab-8823-7e60b0398afd::"
        name                    = "omar-test-icd-elasticsearch-05-30"
      ~ service_endpoints       = "public" -> "private"
        tags                    = []
        # (16 unchanged attributes hidden)

        # (2 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.
โ•ท
โ”‚ Warning: IBM recommends using private endpoints only to improve security by restricting access to your database to the IBM Cloud private network. For more information, please refer to our security best practices, https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-manage-security-compliance.
โ”‚ 
โ”‚   with ibm_database.elasticsearch,
โ”‚   on main.tf line 44, in resource "ibm_database" "elasticsearch":
โ”‚   44: resource "ibm_database" "elasticsearch" {
โ”‚ 

Example of Warning in terraform apply after user set service endpoints to public:

 Warning: IBM recommends using private endpoints only to improve security by restricting access to your database to the IBM Cloud private network. For more information, please refer to our security best practices, https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-manage-security-compliance.
โ”‚ 
โ”‚   with ibm_database.elasticsearch,
โ”‚   on main.tf line 44, in resource "ibm_database" "elasticsearch":
โ”‚   44: resource "ibm_database" "elasticsearch" {
โ”‚ 
โ•ต

Example of Error when user left out service_endpoints:

โ•ท
โ”‚ Error: Missing required argument
โ”‚ 
โ”‚   on main.tf line 44, in resource "ibm_database" "elasticsearch":
โ”‚   44: resource "ibm_database" "elasticsearch" {
โ”‚ 
โ”‚ The argument "service_endpoints" is required, but no definition was found.

Output from acceptance testing:

$ make testacc TEST=./ibm/service/database
--- PASS: TestValidateUserPassword (0.00s)
--- PASS: TestValidateRBACRole (0.00s)
--- PASS: TestAppendSwitchoverWarning (0.00s)
--- PASS: TestPublicServiceEndpointsWarning (0.00s)
--- PASS: TestAccIBMDatabaseConnectionDataSourceBasic (647.50s)
--- PASS: TestAccIBMDatabaseInstanceEtcdImport (475.67s)
--- PASS: TestAccIBMDatabaseInstanceRedisImport (510.50s)
--- PASS: TestAccIBMDatabaseInstancePostgresImport (617.13s)
--- PASS: TestAccIBMDatabaseDataSource_basic (708.68s)
--- PASS: TestAccIBMDatabaseInstance_Redis_Basic (932.09s)
--- PASS: TestAccIBMDatabaseInstanceRabbitmqImport (372.72s)
--- PASS: TestAccIBMDatabaseInstance_Rabbitmq_Basic (1331.18s)
--- PASS: TestAccIBMDatabaseInstance_ElasticsearchPlatinum_Group (1479.86s)
--- PASS: TestAccIBMDatabaseInstanceElasticsearchPlatinumImport (3738.51s)
--- PASS: TestAccIBMDatabaseInstance_ElasticsearchPlatinum_Basic (1005.96s)
--- PASS: TestAccIBMDatabaseInstance_Etcd_Basic (5107.58s)
--- PASS: TestAccIBMMysqlDatabaseInstanceBasic (3526.58s)
--- PASS: TestAccIBMDatabaseInstanceMongodbBasic (3695.07s)
--- PASS: TestAccIBMDatabaseInstancePostgresPITR (1343.35s)
--- PASS: TestAccIBMDatabaseInstance_ElasticsearchPlatinum_Node (1772.69s)
...