DICOM Store onboarding support

[gjkamstra]

DICOM Store onboarding has a two stage approach. You first submit a ticket to get it. After that you have to perform >15 steps to make it work correctly. The steps are slightly different depending on whether you use a shared or dedicated instance.

The steps contain the following:

Permissions and account setup in IAM
This is covered by the provider already.

CDR Setup
This is covered by the provider already.

S3 Creds setup
This requires new a new resource type in the provider: hsdp_s3creds_policy.
We could also have a DataSource for defining the actual S3 Creds (hsdp_s3_creds). We can then refer to that in the next step.
It requires an IAM group etag as input, not sure if that can be retrieved from the IAM Group already.

Configure DICOM Store
This requires multiple new resource types in the provider.

• hsdp_dicom_store_cdr_service_account: Needs to setup the service account the DICOM Store uses to access the CDR. I would expect to have this a property on a hsdp_dicom_store resource, but the dicom Store is provisioned by a ticket
• hsdp_dicomStore_object_store: Defines a storage location in the S3 Creds for storing the data. Probably easiest to have a reference to hsdp_s3_creds
• hsdp_dicomStore_repository: Couples an onboarded organization to a hsdp_dicomStore_object_store.

Since all of this does make configuration more clear and robust, it is still a lot of steps to get right. Therefore I also propose to create a Terraform module that takes just a few parameters and sets everything up for you. Something like:

module "my_dicom_store" {
  source = "github.com/philips-labs/terraform-hsdp-dicom-store"
  name                        = "prefix_used_everywhere"
  organization             = hsdp_iam_org.my_org
  s3creds.                   = hsdp_s3creds.my_s3creds
  cdr                            = hsdp_cdr.my_cdr
}

[gjkamstra]

Just discovered there are already S3 creds related resources and datasources called hsdp_credentials_XXX
Maybe we should rename that to s3_credentials? I searched for S3 trying to find it, so I missed it.

[loafoe]

@gjkamstra FYI I have started adding DICOM Config API to the go-hsdp-api library:

philips-software/go-hsdp-api#33

[gjkamstra]

Feel free to invite me as a reviewer for that @loafoe if you like an extra pair of eyes.

[loafoe]

@gjkamstra the PR is now ready for review, and most of the initial work on the TF provider is done as well :)

[loafoe]

The PR for DICOM support is also there now: #40

[loafoe]

v0.10.0 of the providers brings in support for DICOM configuration and onboarding. The focus for this initial release is on support DICOM shared instances, mainly because I don't have access yet to a dedicated instance, haha. The next step is to come up with a module which implements most/all steps of the onboarding process. Below is an example of the HCL I used during testing:

resource "hsdp_dicom_store_config" "dicom" {
  config_url      = "https://config-share.domain"
  organization_id = var.iam_org_id
}

resource "hsdp_dicom_object_store" "dicom" {
  config_url      = hsdp_dicom_store_config.dicom.config_url
  organization_id = var.iam_org_id
  description     = "First Terraform managed Object Store"

  static_access {
    endpoint    = "s3-external-1.amazonaws.com"
    bucket_name = "cf-s3-redacted"
    access_key  = "[REDACTED]"
    secret_key  = "[REDACTED]"
  }
}

resource "hsdp_dicom_repository" "repo1" {
  config_url      = hsdp_dicom_store_config.dicom.config_url
  organization_id = var.iam_org_id
  object_store_id = hsdp_dicom_object_store.dicom.id
}

output "dicom_config_url" {
  value = hsdp_dicom_store_config.dicom.config_url
}

output "dicom_stow_url" {
  value = hsdp_dicom_store_config.dicom.stow_url
}

output "dicom_qido_url" {
  value = hsdp_dicom_store_config.dicom.qido_url
}

output "dicom_wado_url" {
  value = hsdp_dicom_store_config.dicom.wado_url
}