This module is to set up a list of s2s authorization policies, and cbr rules
HCLApache-2.0
Terraform IBM Service-to-service authorization module
This module generates authorization policies and context-based restriction (CBR) rules to enable access and restrictions between a source service and a target service.
module"service_auth_cbr_rules" {
source="terraform-ibm-modules/s2s-auth/ibm"version="X.X.X"# Replace "X.X.X" with a release version to lock into a specific releaseservice_map=[
{
"description"="This is a test auth policy",
"enforcement_mode"="report",
"roles"= [
"Reader"
],
"source_resource_instance_id"="<source_resource_instance_guid>",
"source_service_name"="cloud-object-storage",
"target_resource_instance_id"="<target_resource_instance_guid>",
"target_service_name"="kms"
},
{
"description"="This is a test auth policy",
"enforcement_mode"="report",
"roles"= [
"Reader"
],
"source_rg"="<source_rg>",
"source_service_name"="containers-kubernetes",
"target_rg"="<target_rg>",
"target_service_name"="kms"
}
]
}
Required IAM access policies
You need the following permissions to run this module.
You must have access to the target service to create an authorization between services. You can grant only the level of access that you have as a user of the target service. For example, if you have viewer access on the target service, you can assign only the viewer role for the authorization.