Skip to content

Commit fd96bf9

Browse files
Khuzaima05Khuzaima05
authored
feat: Added new Quickstart DA variation (#1082)
1 parent 62792d2 commit fd96bf9

15 files changed

+910
-10
lines changed

‎.catalog-onboard-pipeline.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,6 @@ offerings:
1313
instance_id: 1c7d5f78-9262-44c3-b779-b28fe4d88c37
1414
region: us-south
1515
scope_resource_group_var_name: existing_resource_group_name
16+
- name: quickstart
17+
mark_ready: false
18+
install_type: fullstack

‎common-dev-assets‎

‎ibm_catalog.json‎

Lines changed: 193 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@
6969
"label": "Standard - Integrated setup with configurable services",
7070
"name": "fully-configurable",
7171
"short_description": "Ideal for users who want flexibility with a reliable starting point.",
72-
"index": 1,
72+
"index": 2,
7373
"install_type": "fullstack",
7474
"working_directory": "solutions/fully-configurable",
7575
"release_notes_url": "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-secure-infrastructure-vpc-relnotes",
@@ -224,7 +224,6 @@
224224
"key": "enable_platform_metrics",
225225
"type": "boolean",
226226
"default_value": false,
227-
"description": "When set to `true`, the IBM Cloud Monitoring instance will be configured to collect platform metrics from the provided region. You can configure 1 instance only of the IBM Cloud Monitoring service per region to collect platform metrics in that location. Check with the account or service administrator if another monitoring instance has already been configured. You may not have permissions to see all monitoring instances in the region. [Learn more](https://cloud.ibm.com/docs/monitoring?topic=monitoring-platform_metrics_enabling).",
228227
"required": true,
229228
"virtual": true,
230229
"options": [
@@ -242,7 +241,6 @@
242241
"key": "logs_routing_tenant_regions",
243242
"type": "array",
244243
"default_value": [],
245-
"description": "To manage platform logs that are generated by IBM Cloud services in a region of IBM Cloud, you must create a tenant in each region that you operate. Pass a list of regions to create a tenant in. [Learn more](https://cloud.ibm.com/docs/logs-router?topic=logs-router-about-platform-logs).",
246244
"required": true,
247245
"virtual": true,
248246
"custom_config": {
@@ -263,9 +261,7 @@
263261
"config_constraints": {
264262
"identifier": "rg_name"
265263
}
266-
},
267-
"default_value": "Default",
268-
"description": "The name of an existing resource group to provision the resources."
264+
}
269265
},
270266
{
271267
"key": "subnets"
@@ -826,6 +822,197 @@
826822
"dependency_version_2": true,
827823
"terraform_version": "1.12.2",
828824
"ignore_readme": true
825+
},
826+
{
827+
"label": "QuickStart - Basic and simple",
828+
"short_description": "Ideal for users new to IBM Cloud or Virtual Private Cloud (VPC) who want to get started without configuring underlying infrastructure.",
829+
"name": "quickstart",
830+
"index": 1,
831+
"install_type": "fullstack",
832+
"working_directory": "solutions/quickstart",
833+
"release_notes_url": "https://cloud.ibm.com/docs/secure-infrastructure-vpc?topic=secure-infrastructure-vpc-secure-infrastructure-vpc-relnotes",
834+
"architecture": {
835+
"features": [
836+
{
837+
"title": " ",
838+
"description": "A lightweight, experimental configuration for quickly provisioning Virtual Private Cloud (VPC) instances on IBM Cloud."
839+
}
840+
],
841+
"diagrams": [
842+
{
843+
"diagram": {
844+
"caption": "Virtual Private Cloud topology - Quickstart (Basic and simple)",
845+
"url": "https://raw.githubusercontent.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/main/reference-architectures/deployable-architecture-quickstart-vpc.svg",
846+
"type": "image/svg+xml"
847+
},
848+
"description": "This architecture provisions and configures a Virtual Private Cloud (VPC) environment with one subnet per zone, resulting in three subnets. The network behavior is controlled by a user-selected Network Profile - Unrestricted, Public Web Services, Private Only, or Isolated - each enforcing a predefined ACL configuration that defines permitted traffic patterns. The chosen profile also determines whether a public gateway is created and whether default security groups are cleaned up. Refer the [Network Profile](https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/solutions/quickstart/DA-types.md) documentation for more details. The solution optionally enables VPC Flow Logs, creating a Cloud Object Storage instance and bucket for storing VPC Flow Logs."
849+
}
850+
]
851+
},
852+
"iam_permissions": [
853+
{
854+
"role_crns": [
855+
"crn:v1:bluemix:public:iam::::role:Viewer"
856+
],
857+
"service_name": "Resource group only",
858+
"notes": "Viewer access is required in the resource group you want to provision in."
859+
},
860+
{
861+
"role_crns": [
862+
"crn:v1:bluemix:public:iam::::role:Administrator"
863+
],
864+
"service_name": "is.vpc",
865+
"notes": "Required to create Virtual Private Cloud(VPC)."
866+
},
867+
{
868+
"service_name": "cloud-object-storage",
869+
"role_crns": [
870+
"crn:v1:bluemix:public:iam::::serviceRole:Manager",
871+
"crn:v1:bluemix:public:iam::::role:Editor"
872+
],
873+
"notes": "[Optional] Required if VPC Flow Logs are enabled."
874+
}
875+
],
876+
"configuration": [
877+
{
878+
"key": "ibmcloud_api_key"
879+
},
880+
{
881+
"key": "existing_resource_group_name",
882+
"display_name": "resource_group",
883+
"custom_config": {
884+
"type": "resource_group",
885+
"grouping": "deployment",
886+
"original_grouping": "deployment",
887+
"config_constraints": {
888+
"identifier": "rg_name"
889+
}
890+
}
891+
},
892+
{
893+
"key": "prefix",
894+
"required": true,
895+
"default_value": "dev",
896+
"random_string": {
897+
"length": 4
898+
},
899+
"value_constraints": [
900+
{
901+
"type": "regex",
902+
"description": "Prefix must begin with a lowercase letter and may contain only lowercase letters, digits, and hyphens '-'. It must not end with a hyphen('-'), and cannot contain consecutive hyphens ('--'). It should not exceed 16 characters.",
903+
"value": "^$|^__NULL__$|^[a-z](?!.*--)(?:[a-z0-9-]{0,14}[a-z0-9])?$"
904+
}
905+
]
906+
},
907+
{
908+
"key": "region",
909+
"required": true,
910+
"custom_config": {
911+
"config_constraints": {
912+
"generationType": "2"
913+
},
914+
"grouping": "deployment",
915+
"original_grouping": "deployment",
916+
"type": "vpc_region"
917+
}
918+
},
919+
{
920+
"key": "vpc_name",
921+
"required": true
922+
},
923+
{
924+
"key": "network_profile",
925+
"type": "string",
926+
"displayname": "Network Profile",
927+
"required": true,
928+
"default_value": "public_web_services",
929+
"options": [
930+
{
931+
"displayname": "Unrestricted (All Traffic Allowed)",
932+
"value": "unrestricted",
933+
"description": "Allows all inbound and outbound traffic from any source (0.0.0.0/0). No network filtering applied. Use only for development or testing environments."
934+
},
935+
{
936+
"displayname": "Public Web Services (SSH, HTTP, HTTPS + IBM Cloud Internal)",
937+
"value": "public_web_services",
938+
"description": "Allows inbound traffic on SSH (port 22), HTTP (port 80), and HTTPS (port 443). Includes IBM Cloud internal service connectivity and VPC-to-VPC communication. Suitable for web-facing applications."
939+
},
940+
{
941+
"displayname": "Private Only (IBM Cloud Internal + VPC)",
942+
"value": "private_only",
943+
"description": "No public internet connectivity. Only allows IBM Cloud internal service communication and VPC-to-VPC traffic. Ideal for backend services and databases."
944+
},
945+
{
946+
"displayname": "Isolated (No Network Access)",
947+
"value": "isolated",
948+
"description": "Completely isolated with no inbound or outbound network traffic allowed. Maximum security for highly sensitive workloads requiring manual network configuration."
949+
}
950+
]
951+
},
952+
{
953+
"key": "resource_tags",
954+
"custom_config": {
955+
"type": "array",
956+
"grouping": "deployment",
957+
"original_grouping": "deployment",
958+
"config_constraints": {
959+
"type": "string"
960+
}
961+
}
962+
},
963+
{
964+
"key": "access_tags",
965+
"custom_config": {
966+
"type": "array",
967+
"grouping": "deployment",
968+
"original_grouping": "deployment",
969+
"config_constraints": {
970+
"type": "string"
971+
}
972+
}
973+
},
974+
{
975+
"key": "enable_vpc_flow_logs",
976+
"type": "boolean",
977+
"type_metadata": "boolean",
978+
"options": [
979+
{
980+
"description": "Do not collect VPC network traffic metadata.",
981+
"displayname": "False",
982+
"value": false
983+
},
984+
{
985+
"description": "Collect and store VPC network traffic metadata to Object Storage for monitoring, analysis, and troubleshooting.",
986+
"displayname": "True",
987+
"value": true
988+
}
989+
]
990+
},
991+
{
992+
"key": "skip_vpc_cos_iam_auth_policy",
993+
"hidden": true
994+
},
995+
{
996+
"key": "provider_visibility",
997+
"hidden": true,
998+
"options": [
999+
{
1000+
"displayname": "private",
1001+
"value": "private"
1002+
},
1003+
{
1004+
"displayname": "public",
1005+
"value": "public"
1006+
},
1007+
{
1008+
"displayname": "public-and-private",
1009+
"value": "public-and-private"
1010+
}
1011+
]
1012+
}
1013+
],
1014+
"terraform_version": "1.12.2",
1015+
"ignore_readme": true
8291016
}
8301017
]
8311018
}

‎reference-architectures/deploy-arch-ibm-vpc-quickstart-vpc.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
---
2+
3+
copyright:
4+
years: 2025
5+
lastupdated: "2025-12-02"
6+
7+
keywords:
8+
9+
subcollection: deployable-reference-architectures
10+
11+
authors:
12+
- name: "Khuzaima Shakeel"
13+
14+
# The release that the reference architecture describes
15+
version: 8.11.0
16+
17+
# Whether the reference architecture is published to Cloud Docs production.
18+
# When set to false, the file is available only in staging. Default is false.
19+
production: true
20+
21+
# Use if the reference architecture has deployable code.
22+
# Value is the URL to land the user in the IBM Cloud catalog details page
23+
# for the deployable architecture.
24+
# See https://test.cloud.ibm.com/docs/get-coding?topic=get-coding-deploy-button
25+
deployment-url: https://cloud.ibm.com/catalog/architecture/deploy-arch-ibm-slz-vpc-9fc0fa64-27af-4fed-9dce-47b3640ba739-global
26+
27+
docs: https://cloud.ibm.com/docs/secure-infrastructure-vpc
28+
29+
image_source: https://github.com/terraform-ibm-modules/terraform-ibm-landing-zone-vpc/blob/main/reference-architectures/deployable-architecture-quickstart-vpc.svg
30+
31+
related_links:
32+
- title: "Cloud foundation for VPC (Standard - Integrated setup with configurable services)"
33+
url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vpc-fully-configurable"
34+
description: "A deployable architecture that provides full control over VPC networking, security, and connectivity components."
35+
- title: "Cloud foundation for VPC (Standard - Financial Services edition)"
36+
url: "https://cloud.ibm.com/docs/deployable-reference-architectures?topic=deployable-reference-architectures-vpc-ra"
37+
description: "A VPC architecture based on IBM Cloud for Financial Services controls."
38+
39+
use-case: Foundational Infrastructure
40+
compliance: None
41+
42+
content-type: reference-architecture
43+
44+
---
45+
46+
{{site.data.keyword.attribute-definition-list}}
47+
48+
# Cloud foundation for VPC – QuickStart (Basic and simple)
49+
{: #vpc-quickstart-ra}
50+
{: toc-content-type="reference-architecture"}
51+
{: toc-industry="CrossIndustry"}
52+
{: toc-use-case="Foundational Infrastructure"}
53+
{: toc-version="1.0.0"}
54+
55+
The QuickStart variation of the Cloud foundation for VPC provides a **basic and simple** Virtual Private Cloud (VPC) deployment that requires minimal configuration. It enables users to quickly create a functional network environment on IBM Cloud. This variation is best suited for users who need a **basic VPC configuration** with lightweight networking defaults and support for VPC Flow Logs.
56+
57+
58+
---
59+
60+
## Architecture diagram
61+
{: #ra-vpc-quickstart-architecture}
62+
63+
![Architecture diagram for the QuickStart variation of Cloud foundation for VPC](deployable-architecture-quickstart-vpc.svg "QuickStart VPC architecture"){: caption="Quickstart variation of Cloud foundation for VPC" caption-side="bottom"}{: external download="deployable-architecture-quickstart-vpc.svg"}
64+
65+
## Design requirements
66+
{: #ra-vpc-qs-design-requirements}
67+
68+
![Design requirements for Cloud foundation for VPC](heat-map-deploy-arch-slz-vpc-quickstart.svg "Design requirements"){: caption="Scope of the design requirements" caption-side="bottom"}
69+
70+
71+
## Requirements
72+
{: #ra-vpc-quickstart-components}
73+
74+
The following table outlines the requirements that are addressed in this architecture.
75+
76+
| Requirement | Component | Reasons for choice | Alternative choice |
77+
|------------|-----------|--------------------|--------------------|
78+
| Provide a basic, ready-to-use VPC with minimal inputs | Predefined VPC | Deploys a VPC quickly without requiring users to design networking components | Use the fully configurable variation for granular control |
79+
| Create availability-zone redundancy | Fixed three-zone subnets | Ensures high availability by provisioning one subnet per zone automatically | Use the fully configurable variation for flexibility |
80+
| Basic traffic governance | Network profile selector (unrestricted, public_web_services, private_only, isolated) | Provides simple, predefined ACL behavior without requiring custom rules | Define custom ACL rules and SG rules manually in the fully configurable variation |
81+
82+
{: caption="QuickStart variation of Cloud foundation for VPC" caption-side="bottom"}
83+
84+
85+
# Key features
86+
{: #ra-vpc-quickstart-features}
87+
88+
## VPC Setup
89+
- Automatically creates a new VPC with IBM-recommended defaults
90+
- Sets up one subnet per zone, resulting in three subnets.
91+
92+
## Built-in Network Profiles
93+
94+
The following network profiles provide predefined security postures by configuring **Network ACLs**, **public gateway access**, and **default security group behavior**. These profiles align exactly with the options exposed in the IBM Cloud catalog UI.
95+
96+
- **Unrestricted (All Traffic Allowed)**
97+
Allows all inbound and outbound traffic. Suitable for testing or unrestricted workloads.
98+
99+
- **Public Web Services (SSH, HTTP, HTTPS + IBM Cloud Internal)** *(Default)*
100+
Allows traffic on common service ports (SSH 22, HTTP 80, HTTPS 443), enables IBM Cloud internal connectivity.
101+
102+
- **Private Only (IBM Cloud Internal + VPC)**
103+
No external/public connectivity. Only IBM internal and VPC connectivity allowed. Intended for internal-only workloads that must not be exposed publicly.
104+
Learn more: https://cloud.ibm.com/docs/vpc?topic=vpc-about-networking#private-network
105+
106+
- **Isolated (No Network Access)**
107+
Fully locked-down environment with no inbound or outbound connectivity. Suitable for highly sensitive or isolated security scenarios.
108+
109+
110+
## Security & Network Defaults
111+
- ACLs applied according to the selected network profile
112+
- Security group automatically cleaned for restrictive profiles
113+
- Public gateways created only when allowed by the profile
114+
115+
## Flow Logs
116+
- When enabled, VPC Flow Logs capture network traffic metadata and automatically create an IBM Cloud Object Storage (COS) instance and bucket to store the logs.

‎reference-architectures/deployable-architecture-quickstart-vpc.svg‎

Lines changed: 4 additions & 0 deletions
Loading

‎reference-architectures/heat-map-deploy-arch-slz-vpc-quickstart.svg‎

Lines changed: 4 additions & 0 deletions
Loading

‎solutions/quickstart/DA-types.md‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
## Configuring network profile input for VPC <a name="network-profile"></a>
2+
3+
This variable lets you choose from predefined network security profiles that control the default **Network ACL behavior**, **public gateway availability**, and whether **default Security Group (SG) rules are cleaned**. It simplifies deployment by offering four security levels ranging from fully open to fully restricted.
4+
5+
- **Variable name:** `network_profile`
6+
- **Type:** `string`
7+
- **Default value:** `"public_web_services"`
8+
- **Allowed values:** `unrestricted`, `public_web_services`, `private_only`, `isolated`
9+
10+
The selected network profile automatically defines the following behavior:
11+
12+
| Profile | Default Behavior | Public Gateway | Default Security Group Rules |
13+
|-------------------------------------------------------------|----------------------------------------------------------------------------------|----------------|------------------------------|
14+
| **Unrestricted (All Traffic Allowed)** | Allows all inbound and outbound traffic | **Enabled** | Explicit SG rules added: allow all inbound and outbound traffic. |
15+
| **Public Web Services (SSH, HTTP, HTTPS + IBM Cloud Internal)** *(Default)* | Allows traffic on common service ports (SSH 22, HTTP 80, HTTPS 443), enables IBM Cloud internal connectivity. | **Enabled** | Explicit SG rules added: inbound SSH (22), HTTP (80), HTTPS (443). Default SG outbound behavior (allow all outbound) is preserved. |
16+
| **Private Only (IBM Cloud Internal + VPC)** | No external/public connectivity. Only IBM internal and VPC connectivity allowed. | **Disabled** | **Cleaned** |
17+
| **Isolated (No Network Access)** | Fully locked-down environment with no inbound or outbound traffic | **Disabled** | **Cleaned** |
18+
19+
20+
### When to use which profile?
21+
22+
| Scenario / Intent | Recommended Profile |
23+
|-------------------------------------------------------------------|---------------------|
24+
| Experimenting or testing without restrictions | `Unrestricted` |
25+
| Standard workloads that require access on common ports such as SSH, HTTP, and HTTPS. | `Public Web Services` |
26+
| Internal-only workloads that must communicate only within IBM Cloud using the private backbone network (no public internet exposure). [Learn more](https://cloud.ibm.com/docs/vpc?topic=vpc-private-network-connectivity#:~:text=A%20private%20backbone%20for%20all%20connectivity) | `Private Only` |
27+
| High-security isolated setups without external communication | `Isolated` |
28+
29+
---

0 commit comments

Comments
 (0)