Manage IBM Cloud Security and Compliance Center resources via Terraform
IBM Cloud Security and Compliance Center resources are now available in the IBM Terraform plugin. It allows you to work with notes and occurrences which are part of the Security Insights. As of today you can also use the Admin APIs to check your current location settings and use the resource to switch to a new location.
In this post we will try to create some notes/occurrences and view them on the dashboard. Here is my starting state in the dashboard
As can be seen in the above dashboard, I have few vulnerable docker images residing in my IBM Cloud container registry and few certificates which have expired. The offering allows you to configure alerts so you can be alerted and take actions to fix those. We will cover the alerting mechanism in some other blog.
Let’s say we are implementing a K8s dynamic admission webhook controller which doesn’t allow resources to be created if any of the following is true:
It’s a freeze window or if the deployment doesn’t have a valid change request created say in a tool like ServiceNow.
Get Ashish K Thakur’s stories in your inbox
Join Medium for free to get updates from this writer.
Next we translate these requirements into Terraform resources.
You can also get the source code at https://github.com/ashishth09/scc-terraform. Next we apply the resources.
Once the resources are created successfully we head over to the Insights dashboard. We can see a new section called Terraform Insights has appeared. It contains a card Policy gate enforcement which shows the two conditions when a deployment of K8s resources shouldn’t be allowed. We also applied a sample occurrence resource which appears as a bar in the graph. It shows that one attempt was made to deploy resources in our cluster during an active freeze window.
We can click on “View related findings” to know more details about it.
Thanks to Gaurav Goswami, Princedey Reetesh Singh and Harini Reddy for making this possible.
