Protecting catalogs with context-based restrictions

Example by using the console

By creating network zones, you establish a list of allowed locations where an access request originates. Add the Catalog Management service to that allowlist as a service reference. After you create a network zone, you can add it to a rule.

To create a network zone, complete the following steps:

1. In the IBM Cloud console, click Manage > Context-based restrictions, and select Network zones.

2. Click Create.

   Instead of creating a zone by using UI inputs, you can use the JSON code form to directly enter JSON to create a zone by clicking Enter as JSON code.

3. Enter a unique name and a description. For example, "Catalog zone" and "Allow catalogs to interact with other services".

4. Reference a service. Select the service type "IAM services" and then select the Catalog Management service. Click Add to associate the service's IP addresses with your network zone.

5. Click Next to review your network zone.

6. Click Create.

Example by using the CLI

By creating network zones, you establish a list of allowed locations where an access request originates. Add the Catalog Management service to that allowlist as a service reference. After you create a network zone, you can add it to a rule.

1. Install the Context-based restrictions CLI plug-in by running the following command:

   ibmcloud plugin install cbr
   

2. To create a network zone, use the cbr zone-create command.

   The following example creates a network zone with a service reference. For more information, see Service references.

   ibmcloud cbr zone-create --name CatalogZone --description "Allow catalogs to interact with other services" --service-ref service_name=globalcatalog-collection
   

   To find a list of available service references, run the ibmcloud cbr service-ref-targets command.

Example by using the API

By creating network zones, you establish a list of allowed locations where an access request originates. Add the Catalog Management service to that allowlist as a service reference. After you create a network zone, you can add it to a rule.

To create a network zone that includes the Catalog Management service, call the Context-based restrictions API as shown in the following example:

{
  "name": "Catalog zone",
  "description": "Allow catalogs to interact with other services",
  "addresses": [
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "globalcatalog-collection"
      }
    }
  ]
}

AddressIPAddress ipAddressModel = new AddressIPAddress.Builder()
ServiceRefValue serviceRefValueModel = new ServiceRefValue.Builder()
  .accountId(accountID)
  .serviceName("globalcatalog-collection")
  .build();
AddressServiceRef serviceRefAddressModel = new AddressServiceRef.Builder()
  .type("serviceRef")
  .ref(serviceRefValueModel)
  .build();
CreateZoneOptions createZoneOptions = new CreateZoneOptions.Builder()
  .name("Catalog zone")
  .accountId(accountID)
  .description("Allow catalogs to interact with other services")
  .addresses(java.util.Arrays.asList(ipAddressModel, ipRangeAddressModel, subnetAddressModel, vpcAddressModel, serviceRefAddressModel))
  .excluded(java.util.Arrays.asList(excludedIPAddressModel))
  .build();

Response<Zone> response = contextBasedRestrictionsService.createZone(createZoneOptions).execute();
Zone zone = response.getResult();

System.out.println(zone);

// Request models needed by this operation.

// AddressServiceRef
const serviceRefAddressModel = {
  type: 'serviceRef',
  ref: {
    account_id: accountId,
    service_name: 'globalcatalog-collection',
  },
};

const params = {
  name: 'Catalog zone',
  accountId,
  addresses: [ipAddressModel, ipRangeAddressModel, subnetAddressModel, vpcAddressModel, serviceRefAddressModel],
  excluded: [excludedIPAddressModel],
  description: 'Allow catalogs to interact with other services',
};

try {
  const res = await contextBasedRestrictionsService.createZone(params);
  zoneId = res.result.id;
  zoneRev = res.headers.etag;
  console.log(JSON.stringify(res.result, null, 2));
} catch (err) {
  console.warn(err);
}

service_ref_address_model = {
  'type': 'serviceRef',
  'ref': {
    'account_id': account_id,
    'service_name': 'globalcatalog-collection',
  }
}

zone = context_based_restrictions_service.create_zone(
  name='catalog zone',
  account_id=account_id,
  addresses=[service_ref_address_model],
  description='allow catalogs to interact with other services',
).get_result()

print(json.dumps(zone, indent=2))

serviceRefAddressModel := &contextbasedrestrictionsv1.AddressServiceRef{
  Type: core.StringPtr("serviceRef"),
  Ref: &contextbasedrestrictionsv1.ServiceRefValue{
    AccountID:   core.StringPtr(accountID),
    ServiceName: core.StringPtr("globalcatalog-collection"),
  },

createZoneOptions := contextBasedRestrictionsService.NewCreateZoneOptions()
createZoneOptions.SetName("catalog zone")
createZoneOptions.SetAccountID(accountID)
createZoneOptions.SetDescription("allow catalogs to interact with other services")
createZoneOptions.SetAddresses([]contextbasedrestrictionsv1.AddressIntf{serviceRefAddressModel})

zone, response, err := contextBasedRestrictionsService.CreateZone(createZoneOptions)
if err != nil {
  panic(err)
}
b, _ := json.MarshalIndent(zone, "", "  ")
fmt.Println(string(b))

To find a list of available service references, call the ListAvailableServicerefTargets method.