Protecting Secrets Manager resources with context-based restrictions

Creating network zones by using the API

You can create network zones by using the create-zone command. For more information, see the API docs. You can add Secrets Manager to network zones as a service reference to allow Secrets Manager to access resources and services in your account that are the subject of a rule.

The serviceRef attribute for Secrets Manager is secrets-manager.

You can determine which services are available by checking for reference targets.

Example payload to add Secrets Manager to a network zone.

{
  "name": "Example zone 1",
  "description": "",
  "addresses": [
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "secrets-manager",
        "account_id": "ACCOUNT-ID"
      }
    }
  ]
}

Example payload to add multiple services, IP addresses, and VPCs to a network zone.

{
  "name": "zone",
  "description": "",
  "addresses": [
    {
      "type": "ipAddress",
      "value": "192.168.0.0"
    },
    {
      "type": "vpc",
      "value": "crn:v1:bluemix:public:is:us-east:a/CRN"
    },
    {
      "type": "vpc",
      "value": "crn:v1:bluemix:public:is:us-south:a/CRN"
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "cloud-object-storage",
        "account_id": "ACCOUNT-ID"
      }
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "codeengine",
        "account_id": "ACCOUNT-ID"
      }
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "containers-kubernetes",
        "account_id": "ACCOUNT-ID"
      }
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_type": "platform_service",
        "account_id": "ACCOUNT-ID"
      }
    },
    {
      "type": "serviceRef",
      "ref": {
        "service_name": "iam-groups",
        "account_id": "ACCOUNT-ID"
      }
    }
  ],
  "excluded": []
}

After you create zones, you can update or remove them.

Creating network zones by using the UI

After you set the prerequisites and requirements, you can create zones in the UI. For more information, see Creating context-based restrictions.

1. Determine the resources that you want add to your allowlist.
2. Follow the steps to create context-based restrictions in the console. Add the Secrets Manager service to your network zones to allow IBM Cloud® Secrets Manager to access services and resources in your account.

After you create zones, you can also update or remove them.

Creating network zones by using the CLI

You can use the cbr-zone-create command to add network locations, VPCs, and service references to network zones. For more information, see the CBR CLI reference. Add Secrets Manager to network zones as a service reference to allow Secrets Manager to access resources and services in your account that are the subject of a rule.

1. To create network zones from the CLI, install the CBR CLI plug-in.
2. Use the cbr-zone-create command to add resources to network zones. For more information, see the CBR CLI reference. Note that the service_name for Secrets Manager is secrets-manager.

To find a list of available service references, run the ibmcloud cbr service-ref-targets command.

Example command to add the secrets-manager service to a network zone.

ibmcloud cbr zone-create --name example-zone-1 --description "Example zone 1" --service-ref service_name=secrets-manager

Create rules by using the API

You can define rules with the API by using the information that you collected from creating network zones.

Review the following example to learn how to create rules for Secrets Manager. For more information, see the API docs.

The following example payload creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID zone can access the cluster. Given that no operations are specified, resources in the NETWORK-ZONE-ID zone can access both the cluster and management APIs.

{
  "description": "Example rule 1",
  "resources": [
    {
      "attributes": [
        {
          "name": "accountId",
          "value": "ACCOUNT-ID"
        },
        {
          "name": "serviceName",
          "value": "secrets-manager"
        },
        {
          "name": "serviceInstance",
          "value": "CLUSTER-ID"
        }
      ]
    }
  ],
  "contexts": [
    {
      "attributes": [
        {
          "name": "networkZoneId",
          "value": "NETWORK-ZONE-ID"
        },
        {
          "name": "endpointType",
          "value": "private"
        }
      ]
    }
  ]
}

After you create rules, you can update and delete them.

Creating rules by using the UI

After you set the prerequisites and requirements, you can create rules in the UI.

1. Determine the resources that you want add to your allowlist.
2. Follow the steps to create context-based restrictions in the console. Add the Secrets Manager service to your network zones to allow IBM Cloud® Secrets Manager to access services and resources in your account.

After you create rules, you can update and delete them.

Create rules by using the CLI

Review the following examples to learn how to create rules for Secrets Manager. For more information, see the CBR CLI reference.

1. To create rules from the CLI, install the CBR CLI plug-in.
2. You can use the ibmcloud cbr rule-create command to create CBR rules. For more information, see the CBR CLI reference. Note that the service_name for Secrets Manager is secrets-manager. To find a list of service names, run the ibmcloud cbr service-ref-targets command. To find a list of API types for a service, run the ibmcloud cbr api-types --service-name SERVICE command.

Example command to create a rule that uses the addresses key and the cluster API type and the ipAddress type.

ibmcloud cbr rule-create my-rule-1 --service-name secrets-manager --api-type crn:v1:bluemix:public:secrets-manager::::api-type:cluster --zone-id ZONE-ID

The following command creates a rule that protects the CLUSTER-ID cluster. Only resources in the NETWORK-ZONE-ID network zone can access the cluster. This rule includes both the cluster and management API types.

ibmcloud cbr rule-create my-rule-2 --service-name secrets-manager --service-instance CLUSTER-ID --zone-id NETWORK-ZONE-ID