cli parameters for kms configuration missing

[Blaimi]

Hi,

I want to create an App ID Instance via terraform/schematics and use my own kms configuration. Sadly I cannot find the parameters-configuration to use when creating the service.

Links:

• HowTo via UI: https://cloud.ibm.com/docs/appid?topic=appid-mng-data#enable-customer-keys-kp
• A Stackoverflow with a maybe answer: https://stackoverflow.com/q/73441732/568291
• good docs example for hyper-protect-dbaas-for-mongodb: https://cloud.ibm.com/docs/hyper-protect-dbaas-for-mongodb?topic=hyper-protect-dbaas-for-mongodb-create-service&interface=cli#cli-create-service
• less good docs example for sql-query: https://cloud.ibm.com/docs/sql-query?topic=sql-query-terraform

[Blaimi]

The feature is not officially documented yet but the solution that you had noted in your GitHub post should work for you:

https://stackoverflow.com/questions/73441732/ibm-app-id-what-are-the-parameters-to-configure-custom-encryption-during-provis

Officially documentation is being worked on, but we have no ETA as to when it will be released.

– IBM via support ticket. I's disgraceful to get an answer based on a self-delivered stackoverflow-question after twelve days and multiple explanations of the problem.

I got it running with this configuration (simplified)

resource "ibm_resource_instance" "key_protect_instance" {
  name              = "name-your-kp-instance"
  resource_group_id = data.ibm_resource_group.resource_group.id
  service           = "kms"
  plan              = "tiered-pricing"
  location          = local.ibm_region
}

resource "ibm_kms_key" "appid_root_key" {
  instance_id   = ibm_resource_instance.key_protect_instance.guid
  key_name      = "appid-root-key"
  standard_key  = false
  endpoint_type = "private"
}

resource "ibm_iam_authorization_policy" "appid_kms" {
  source_service_name         = "appid"
  target_service_name         = "kms"
  target_resource_instance_id = ibm_resource_instance.key_protect_instance.guid
  roles                       = ["Reader"]
}

resource "ibm_resource_instance" "appid_instance" {
  name              = "name-your-appid-instance"
  resource_group_id = data.ibm_resource_group.resource_group.id
  service           = "appid"
  plan              = "graduated-tier"
  location          = local.ibm_region
  parameters = {
    kms_info = jsonencode({
      id = ibm_resource_instance.key_protect_instance.guid
      url = "https://${local.ibm_region}.kms.cloud.ibm.com"
    })
    tek_id = ibm_kms_key.appid_root_key.crn
  }
}

[hlucey]

@Blaimi,

I'm sorry for the inconvenience and delayed response. I’m glad to see you were able to run the configuration. I've started investigating to see how we can improve our documentation and passed this issue along.

Thank you for providing this feedback.

• Haley