Enabling event notifications for Secrets Manager

Connecting to Event Notifications in the UI

Before you can enable notifications for Secrets Manager, be sure that you have an Event Notifications service instance that is in the same account as your Secrets Manager instance. Then, you can use the Settings > Event Notifications section in the Secrets Manager UI to connect the services.

1. In the console, click the Menu icon > Resource list.

2. From the list of services, select your instance of Secrets Manager.

3. In the Secrets Manager navigation, click Settings.

4. In the Event Notifications section, and click Connect.

5. In the side panel, review the source details for the connection. Optionally, provide a description.

6. Select the resource group and Event Notifications service instance that you want to connect.

   If an IAM authorization between Secrets Manager and Event Notifications doesn't exist in your account, a dialog is displayed. Follow the prompts to grant access between the services.

   1. To grant access between Secrets Manager and Event Notifications, click Authorize.
   2. In the side panel, select Event Notifications as the target service.
   3. From the list of instances, select the Event Notifications service instance that you want to authorize.
   4. Select the Event Source Manager role.
   5. Click Review.
   6. Click Assign.

7. To confirm the connection, click Connect.

   A success message is displayed to indicate that Secrets Manager is now connected to Event Notifications. If you need to disconnect from Event Notifications later, you can use the options menu > Disconnect to remove the Secrets Manager as a source service in the Event Notifications instance.

   If you choose to disconnect Event Notifications, do not delete the IAM authorization between Secrets Manager and Event Notifications. Secrets Manager uses the existing authorization to unregister from Event Notifications. If an Event Notifications instance is deleted, any authorizations that exist between the service and the Secrets Manager are also deleted by IAM.

Connecting to Event Notifications with the API

Before you can enable notifications for Secrets Manager, be sure that you have an Event Notifications service instance that is in the same account as your Secrets Manager instance. Then, you can connect to Event Notifications programmatically by calling the Secrets Manager API.

The following example shows a query that you can use to register your Secrets Manager source details with Event Notifications. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

You can find the event_notifications_instance_crn value in the console by going to the Resource list and clicking the Event Notifications instance row.

curl -X POST 
   --H "Authorization: Bearer {iam_token}" \
   --H "Accept: application/json" \
   --H "Content-Type: application/json" \
   --d'{
      "event_notifications_instance_crn": "crn:v1:bluemix:public:event-notifications:us-south:a/22018f3c34ff4ff193698d15ca316946:578ad1a4-2fd8-4e66-95d5-79a842ba91f8::",
      "event_notifications_source_description": "Optional description of this source in an Event Notifications instance.",
      "event_notifications_source_name": "My Secrets Manager"
   }' \
"https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/notifications/registration"

A successful request returns the CRN value of your connected Event Notifications service instance. For more information about the required and optional request parameters, see the API docs.

Connecting to Event Notifications with Terraform

The following example shows a configuration that you can use to to register your Secrets Manager source details with Event Notifications.

    resource "ibm_sm_en_registration" "en_registration" {
        instance_id = local.instance_id
        region = local.region
        name = "test-root-ca"
        event_notifications_instance_crn = var.en_instance_crn
        event_notifications_source_description = "My event notification source"
        event_notifications_source_name = "my_en_source"
    }

Sending a test event to Event Notifications in the UI

After you enable notifications for Secrets Manager, test your connection to ensure that the events that are generated by Secrets Manager are being forwarded to Event Notifications.

Before you can send a test Secrets Manager events, you must have topics, destinations, and subscriptions created in your Event Notifications instance. Be sure that the Test event event type (com.ibm.cloud.secrets-manager.test_event) is included as a condition in your Event Notifications topic.

1. In the Secrets Manager UI, click Settings.

2. In the Event Notifications section, click Send test event.

   A success message is displayed to indicate that the test event was forwarded successfully to Event Notifications.

Sending a test event to Event Notifications with the API

After you enable notifications for Secrets Manager, test your connection to ensure that the events that are generated by Secrets Manager are being forwarded to Event Notifications.

Before you can send a test Secrets Manager event, you must have topics, destinations, and subscriptions created in your Event Notifications instance. Be sure that the Test event event type (com.ibm.cloud.secrets-manager.test_event) is included as a condition in your Event Notifications topic.

The following example shows a query that you can use to send a test event from the Secrets Manager to Event Notifications. When you call the API, replace the ID variables and IAM token with the values that are specific to your Secrets Manager instance.

curl -X GET 
   --H "Authorization: Bearer {iam_token}" \
   "https://{instance_ID}.{region}.secrets-manager.appdomain.cloud/api/v2/notifications/registration/test"

A successful request returns an HTTP 200 OK response to indicate that a test event was forwarded successfully to your connected Event Notifications service instance. For more information, see the API docs.