You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Add new optional variable ibmcloud_kms_api_key. This should be used in a new provider block like so:
provider "ibm" {
alias = "kms"
ibmcloud_api_key = var.ibmcloud_kms_api_key != null ? var.ibmcloud_kms_api_key : var.ibmcloud_api_key
region = local.kms_region # this value should be parsed from the existing KMS CRN
}
provider "ibm" {
ibmcloud_api_key = var.ibmcloud_api_key
region = var.region
}
The kms module block should use the kms provider alias.
Support creating cross account s2s auth policy (in KMS account):
if value for ibmcloud_kms_api_key is passed, and skip_iam_authorization_policy is set to false, then create a cross account s2s auth policy in the KMS account to allow the exact Event Notification instance GUID reader access to the KMS instance GUID in the KMS account.
Ensure that if doing cross account auth policy, the skip_iam_authorization_policy value thats passed to the EN module itself is set to true since we will create the cross account one in the DA itself.
Review all of the variable descriptions and readme markdowns to ensure its clear that it supports KMS in a different account using the ibmcloud_kms_api_key variable.
The text was updated successfully, but these errors were encountered:
Changes should go into
solutions/standard
only..Add new optional variable
ibmcloud_kms_api_key
. This should be used in a new provider block like so:The
kms
module block should use thekms
provider alias.Support creating cross account s2s auth policy (in KMS account):
ibmcloud_kms_api_key
is passed, andskip_iam_authorization_policy
is set to false, then create a cross account s2s auth policy in the KMS account to allow the exact Event Notification instance GUID reader access to the KMS instance GUID in the KMS account.skip_iam_authorization_policy
value thats passed to the EN module itself is set totrue
since we will create the cross account one in the DA itself.Review all of the variable descriptions and readme markdowns to ensure its clear that it supports KMS in a different account using the
ibmcloud_kms_api_key
variable.The text was updated successfully, but these errors were encountered: