Changes should go into solutions/secure-cross-regional-bucket and solutions/secure-regional-bucket only..
Add new optional variable ibmcloud_kms_api_key. This should be used in a new provider block like so:
provider "ibm" {
alias = "kms"
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
region = local.kms_region # this value should be parsed from the existing KMS CRN
}
The kms module block should use the kms provider alias (its already set up like this in the code actually).
Support creating cross account s2s auth policy (in KMS account):
if value for ibmcloud_kms_api_key is passed, and skip_iam_authorization_policy is set to false, then create a cross account s2s auth policy in the KMS account to allow the COS bucket reader access to the KMS instance GUID in the KMS account.
Ensure that if doing cross account auth policy, the skip_iam_authorization_policy value thats passed to the COS module itself is set to true since we will create the cross account one in the DA itself.
Review all of the variable descriptions and readme markdowns to ensure its clear that it supports KMS in a different account using the ibmcloud_kms_api_key variable.
Changes should go into
solutions/secure-cross-regional-bucketandsolutions/secure-regional-bucketonly..Add new optional variable
ibmcloud_kms_api_key. This should be used in a new provider block like so:The
kmsmodule block should use thekmsprovider alias (its already set up like this in the code actually).Support creating cross account s2s auth policy (in KMS account):
ibmcloud_kms_api_keyis passed, andskip_iam_authorization_policyis set to false, then create a cross account s2s auth policy in the KMS account to allow the COS bucket reader access to the KMS instance GUID in the KMS account.skip_iam_authorization_policyvalue thats passed to the COS module itself is set totruesince we will create the cross account one in the DA itself.Review all of the variable descriptions and readme markdowns to ensure its clear that it supports KMS in a different account using the
ibmcloud_kms_api_keyvariable.