diff --git a/ibm_catalog.json b/ibm_catalog.json index f950ae6b..dd9e0583 100644 --- a/ibm_catalog.json +++ b/ibm_catalog.json @@ -334,7 +334,14 @@ "key": "admin_pass" }, { - "key": "existing_secrets_manager_instance_crn" + "key": "existing_secrets_manager_instance_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] }, { "key": "existing_secrets_manager_endpoint_type", @@ -378,10 +385,24 @@ "key": "kms_encryption_enabled" }, { - "key": "existing_kms_instance_crn" + "key": "existing_kms_instance_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_kms_instance_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] }, { - "key": "existing_kms_key_crn" + "key": "existing_kms_key_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_kms_key_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" + } + ] }, { "key": "kms_endpoint_type", @@ -404,10 +425,24 @@ "key": "key_name" }, { - "key": "backup_crn" + "key": "backup_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'backup_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$" + } + ] }, { - "key": "existing_backup_kms_key_crn" + "key": "existing_backup_kms_key_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_backup_kms_key_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" + } + ] }, { "key": "use_default_backup_encryption_key" @@ -416,10 +451,24 @@ "key": "skip_postgresql_kms_auth_policy" }, { - "key": "existing_postgresql_instance_crn" + "key": "existing_postgresql_instance_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_postgresql_instance_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] }, { - "key": "remote_leader_crn" + "key": "remote_leader_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'remote_leader_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] } ], "terraform_version": "1.12.2", @@ -673,7 +722,14 @@ "key": "admin_pass" }, { - "key": "existing_secrets_manager_instance_crn" + "key": "existing_secrets_manager_instance_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_secrets_manager_instance_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] }, { "key": "skip_postgresql_secrets_manager_auth_policy" @@ -701,10 +757,24 @@ }, { "key": "existing_kms_instance_crn", - "required": true + "required": true, + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_kms_instance_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] }, { - "key": "existing_kms_key_crn" + "key": "existing_kms_key_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_kms_key_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" + } + ] }, { "key": "key_ring_name" @@ -713,19 +783,47 @@ "key": "key_name" }, { - "key": "backup_crn" + "key": "backup_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'backup_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$" + } + ] }, { - "key": "existing_backup_kms_key_crn" + "key": "existing_backup_kms_key_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_backup_kms_key_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$" + } + ] }, { "key": "skip_postgresql_kms_auth_policy" }, { - "key": "existing_postgresql_instance_crn" + "key": "existing_postgresql_instance_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'existing_postgresql_instance_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] }, { - "key": "remote_leader_crn" + "key": "remote_leader_crn", + "value_constraints": [ + { + "type": "regex", + "description": "The value provided for 'remote_leader_crn' is not valid.", + "value": "^__NULL__$|^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$" + } + ] } ], "terraform_version": "1.12.2", diff --git a/solutions/fully-configurable/variables.tf b/solutions/fully-configurable/variables.tf index 995d4435..ea8696d4 100644 --- a/solutions/fully-configurable/variables.tf +++ b/solutions/fully-configurable/variables.tf @@ -62,6 +62,14 @@ variable "existing_postgresql_instance_crn" { type = string default = null description = "The CRN of an existing Databases for Postgresql instance. If no value is specified, a new instance is created." + + validation { + condition = anytrue([ + var.existing_postgresql_instance_crn == null, + can(regex("^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_postgresql_instance_crn)) + ]) + error_message = "The value provided for 'existing_postgresql_instance_crn' is not valid." + } } variable "postgresql_version" { @@ -74,6 +82,14 @@ variable "remote_leader_crn" { type = string description = "A CRN of the leader database to make the replica(read-only) deployment. The leader database is created by a database deployment with the same service ID. A read-only replica is set up to replicate all of your data from the leader deployment to the replica deployment by using asynchronous replication. [Learn more](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-read-only-replicas)." default = null + + validation { + condition = anytrue([ + var.remote_leader_crn == null, + can(regex("^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.remote_leader_crn)) + ]) + error_message = "The value provided for 'remote_leader_crn' is not valid." + } } ############################################################################## @@ -249,12 +265,28 @@ variable "existing_kms_instance_crn" { type = string description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)." default = null + + validation { + condition = anytrue([ + var.existing_kms_instance_crn == null, + can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn)) + ]) + error_message = "The value provided for 'existing_kms_instance_crn' is not valid." + } } variable "existing_kms_key_crn" { type = string description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key to encrypt your data. By default this key is used for both deployment data and backups, but this behaviour can be altered using the optional `existing_backup_kms_key_crn` input. If no value is passed a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)." default = null + + validation { + condition = anytrue([ + var.existing_kms_key_crn == null, + can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn)) + ]) + error_message = "The value provided for 'existing_kms_key_crn’ is not valid." + } } variable "kms_endpoint_type" { @@ -297,6 +329,14 @@ variable "existing_backup_kms_key_crn" { type = string description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input. Alternatively set `use_default_backup_encryption_key` to true to use the IBM Cloud Databases default encryption. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)." default = null + + validation { + condition = anytrue([ + var.existing_backup_kms_key_crn == null, + can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn)) + ]) + error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid." + } } variable "use_default_backup_encryption_key" { @@ -313,7 +353,7 @@ variable "backup_crn" { validation { condition = anytrue([ var.backup_crn == null, - can(regex("^crn:.*:backup:", var.backup_crn)) + can(regex("^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn)) ]) error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'" } @@ -390,6 +430,14 @@ variable "existing_secrets_manager_instance_crn" { type = string default = null description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for PostgreSQL instance." + + validation { + condition = anytrue([ + var.existing_secrets_manager_instance_crn == null, + can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn)) + ]) + error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid." + } } variable "existing_secrets_manager_endpoint_type" { diff --git a/solutions/security-enforced/variables.tf b/solutions/security-enforced/variables.tf index b7599690..dea21e98 100644 --- a/solutions/security-enforced/variables.tf +++ b/solutions/security-enforced/variables.tf @@ -57,6 +57,14 @@ variable "existing_postgresql_instance_crn" { type = string default = null description = "The CRN of an existing Databases for Postgresql instance. If no value is specified, a new instance is created." + + validation { + condition = anytrue([ + var.existing_postgresql_instance_crn == null, + can(regex("^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_postgresql_instance_crn)) + ]) + error_message = "The value provided for 'existing_postgresql_instance_crn' is not valid." + } } variable "postgresql_version" { @@ -69,6 +77,14 @@ variable "remote_leader_crn" { type = string description = "A CRN of the leader database to make the replica(read-only) deployment. The leader database is created by a database deployment with the same service ID. A read-only replica is set up to replicate all of your data from the leader deployment to the replica deployment by using asynchronous replication. [Learn more](https://cloud.ibm.com/docs/databases-for-postgresql?topic=databases-for-postgresql-read-only-replicas)." default = null + + validation { + condition = anytrue([ + var.remote_leader_crn == null, + can(regex("^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.remote_leader_crn)) + ]) + error_message = "The value provided for 'remote_leader_crn' is not valid." + } } ############################################################################## @@ -206,6 +222,14 @@ variable "existing_kms_instance_crn" { type = string description = "The CRN of a Key Protect or Hyper Protect Crypto Services instance. Required to create a new encryption key and key ring which will be used to encrypt both deployment data and backups. To use an existing key, pass values for `existing_kms_key_crn` and/or `existing_backup_kms_key_crn`. Bare in mind that backups encryption is only available in certain regions. See [Bring your own key for backups](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-key-protect&interface=ui#key-byok) and [Using the HPCS Key for Backup encryption](https://cloud.ibm.com/docs/cloud-databases?topic=cloud-databases-hpcs#use-hpcs-backups)." default = null + + validation { + condition = anytrue([ + var.existing_kms_instance_crn == null, + can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_kms_instance_crn)) + ]) + error_message = "The value provided for 'existing_kms_instance_crn' is not valid." + } } variable "existing_kms_key_crn" { @@ -220,6 +244,14 @@ variable "existing_kms_key_crn" { ) error_message = "Either existing_kms_key_crn or existing_kms_instance_crn must be set, but not both." } + + validation { + condition = anytrue([ + var.existing_kms_key_crn == null, + can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_kms_key_crn)) + ]) + error_message = "The value provided for 'existing_kms_key_crn’ is not valid." + } } variable "skip_postgresql_kms_auth_policy" { @@ -251,6 +283,14 @@ variable "existing_backup_kms_key_crn" { type = string description = "The CRN of a Key Protect or Hyper Protect Crypto Services encryption key that you want to use for encrypting the disk that holds deployment backups. If no value is passed, the value of `existing_kms_key_crn` is used. If no value is passed for `existing_kms_key_crn`, a new key will be created in the instance specified in the `existing_kms_instance_crn` input." default = null + + validation { + condition = anytrue([ + var.existing_backup_kms_key_crn == null, + can(regex("^crn:v\\d:(.*:){2}(kms|hs-crypto):(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:key:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", var.existing_backup_kms_key_crn)) + ]) + error_message = "The value provided for 'existing_backup_kms_key_crn' is not valid." + } } variable "backup_crn" { @@ -261,7 +301,7 @@ variable "backup_crn" { validation { condition = anytrue([ var.backup_crn == null, - can(regex("^crn:.*:backup:", var.backup_crn)) + can(regex("^crn:v\\d:(.*:){2}databases-for-postgresql:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}:backup:[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$", var.backup_crn)) ]) error_message = "backup_crn must be null OR starts with 'crn:' and contains ':backup:'" } @@ -327,6 +367,14 @@ variable "existing_secrets_manager_instance_crn" { type = string default = null description = "The CRN of existing secrets manager to use to create service credential secrets for Databases for PostgreSQL instance." + + validation { + condition = anytrue([ + var.existing_secrets_manager_instance_crn == null, + can(regex("^crn:v\\d:(.*:){2}secrets-manager:(.*:)([aos]\\/[\\w_\\-]+):[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}::$", var.existing_secrets_manager_instance_crn)) + ]) + error_message = "The value provided for 'existing_secrets_manager_instance_crn' is not valid." + } } variable "service_credential_secrets" {