IBM Cloud Solution Architect (C1000-175) - Security, Compliance & Optimization¶

# enterprise_security.py
from ibm_cloud_sdk_core.authenticators import IAMAuthenticator
from ibm_platform_services import IamIdentityV1, IamAccessGroupsV2
from ibm_vpc import VpcV1
import json

class EnterpriseSecurityArchitecture:
    """
    Implement enterprise security architecture on IBM Cloud
    """

    def __init__(self, api_key):
        authenticator = IAMAuthenticator(api_key)

        self.iam = IamIdentityV1(authenticator=authenticator)
        self.access_groups = IamAccessGroupsV2(authenticator=authenticator)
        self.vpc = VpcV1('2023-12-19', authenticator=authenticator)

    def implement_least_privilege(self, account_id):
        """Implement least privilege access"""

        # Create access groups for different roles
        groups = {
            'developers': {
                'description': 'Development team access',
                'policies': [
                    {
                        'roles': ['Editor'],
                        'resource_attributes': [
                            {'name': 'resourceGroupId', 'value': 'dev-rg'},
                            {'name': 'serviceType', 'value': 'platform_service'}
                        ]
                    }
                ]
            },
            'operators': {
                'description': 'Operations team access',
                'policies': [
                    {
                        'roles': ['Operator', 'Viewer'],
                        'resource_attributes': [
                            {'name': 'resourceGroupId', 'value': 'prod-rg'}
                        ]
                    }
                ]
            },
            'security-auditors': {
                'description': 'Security audit access',
                'policies': [
                    {
                        'roles': ['Viewer', 'Reader'],
                        'resource_attributes': [
                            {'name': 'serviceType', 'value': 'platform_service'}
                        ]
                    }
                ]
            }
        }

        created_groups = {}
        for group_name, config in groups.items():
            # Create access group
            group = self.access_groups.create_access_group(
                account_id=account_id,
                name=group_name,
                description=config['description']
            ).get_result()

            created_groups[group_name] = group['id']

            # Assign policies
            for policy in config['policies']:
                self.create_access_policy(group['id'], account_id, policy)

        return created_groups

    def implement_network_segmentation(self, vpc_id):
        """Implement network micro-segmentation"""

        # Create security groups for different tiers
        security_groups = {
            'web-tier-sg': {
                'rules': [
                    {'direction': 'inbound', 'protocol': 'tcp', 'port_min': 443, 'port_max': 443, 'remote': '0.0.0.0/0'},
                    {'direction': 'inbound', 'protocol': 'tcp', 'port_min': 80, 'port_max': 80, 'remote': '0.0.0.0/0'},
                    {'direction': 'outbound', 'protocol': 'all'}
                ]
            },
            'app-tier-sg': {
                'rules': [
                    {'direction': 'inbound', 'protocol': 'tcp', 'port_min': 8080, 'port_max': 8080, 'remote_sg': 'web-tier-sg'},
                    {'direction': 'outbound', 'protocol': 'all'}
                ]
            },
            'data-tier-sg': {
                'rules': [
                    {'direction': 'inbound', 'protocol': 'tcp', 'port_min': 5432, 'port_max': 5432, 'remote_sg': 'app-tier-sg'},
                    {'direction': 'outbound', 'protocol': 'all'}
                ]
            }
        }

        created_sgs = {}
        for sg_name, config in security_groups.items():
            # Create security group
            sg = self.vpc.create_security_group(
                vpc={'id': vpc_id},
                name=sg_name
            ).get_result()

            created_sgs[sg_name] = sg['id']

            # Add rules
            for rule in config['rules']:
                self.add_security_group_rule(sg['id'], rule)

        return created_sgs

    def implement_data_encryption(self):
        """Implement comprehensive data encryption"""

        encryption_config = {
            'at_rest': {
                'service': 'Key Protect',
                'features': [
                    'Customer-managed keys',
                    'Automatic key rotation',
                    'Envelope encryption',
                    'Dual authorization'
                ]
            },
            'in_transit': {
                'protocols': ['TLS 1.3'],
                'certificate_management': 'IBM Secrets Manager',
                'mutual_tls': 'For service-to-service communication'
            },
            'in_use': {
                'service': 'Hyper Protect Services',
                'features': [
                    'Confidential computing',
                    'Secure enclaves',
                    'Encrypted memory'
                ]
            }
        }

        return encryption_config

# Terraform for enterprise security
security_tf = '''
# enterprise-security.tf

# IAM Access Groups
resource "ibm_iam_access_group" "developers" {
  name        = "Developers"
  description = "Development team access"
}

resource "ibm_iam_access_group_policy" "developer_policy" {
  access_group_id = ibm_iam_access_group.developers.id
  roles           = ["Editor"]

  resources {
    resource_group_id = ibm_resource_group.dev.id
  }
}

# VPC Security Groups
resource "ibm_is_security_group" "web_tier" {
  name = "web-tier-sg"
  vpc  = ibm_is_vpc.enterprise_vpc.id
}

resource "ibm_is_security_group_rule" "web_inbound_https" {
  group     = ibm_is_security_group.web_tier.id
  direction = "inbound"
  remote    = "0.0.0.0/0"
  tcp {
    port_min = 443
    port_max = 443
  }
}

# Key Protect for encryption
resource "ibm_resource_instance" "key_protect" {
  name              = "enterprise-key-protect"
  service           = "kms"
  plan              = "tiered-pricing"
  location          = "us-south"
  resource_group_id = data.ibm_resource_group.default.id
}

resource "ibm_kms_key" "root_key" {
  instance_id  = ibm_resource_instance.key_protect.guid
  key_name     = "root-key"
  standard_key = false
  force_delete = false
}

# Enable encryption for resources
resource "ibm_database" "encrypted_postgres" {
  name              = "encrypted-database"
  plan              = "standard"
  location          = "us-south"
  service           = "databases-for-postgresql"
  resource_group_id = data.ibm_resource_group.default.id

  key_protect_key = ibm_kms_key.root_key.id

  group {
    group_id = "member"
    memory {
      allocation_mb = 4096
    }
  }
}

# Context-based restrictions
resource "ibm_cbr_zone" "enterprise_zone" {
  name        = "enterprise-allowed-zone"
  description = "Zone for enterprise network"
  account_id  = data.ibm_account.account.id

  addresses {
    type  = "ipRange"
    value = "10.0.0.0/8"
  }

  addresses {
    type = "vpc"
    ref  = ibm_is_vpc.enterprise_vpc.crn
  }
}

resource "ibm_cbr_rule" "restrict_access" {
  description      = "Restrict resource access to enterprise zone"
  context_attributes {
    name  = "networkZoneId"
    value = ibm_cbr_zone.enterprise_zone.id
  }

  resources {
    attributes {
      name  = "accountId"
      value = data.ibm_account.account.id
    }
    attributes {
      name  = "serviceType"
      value = "platform_service"
    }
  }

  enforcement_mode = "enabled"
}
'''

# cost_optimizer.py
from datetime import datetime, timedelta
import json

class IBMCloudCostOptimizer:
    """Identify and implement cost optimization opportunities"""

    def __init__(self, usage_data):
        self.usage_data = usage_data

    def identify_idle_resources(self):
        """Find idle and underutilized resources"""
        idle_resources = {
            'instances': [],
            'volumes': [],
            'load_balancers': [],
            'databases': []
        }

        # Analyze compute instances
        for instance in self.usage_data.get('instances', []):
            if instance.get('cpu_utilization', 0) < 5:
                idle_resources['instances'].append({
                    'id': instance['id'],
                    'name': instance['name'],
                    'cost_per_month': instance['cost'],
                    'recommendation': 'Stop or terminate',
                    'potential_savings': instance['cost']
                })
            elif instance.get('cpu_utilization', 0) < 30:
                # Right-size recommendation
                current_profile = instance['profile']
                recommended_profile = self._recommend_smaller_profile(current_profile)
                idle_resources['instances'].append({
                    'id': instance['id'],
                    'name': instance['name'],
                    'cost_per_month': instance['cost'],
                    'recommendation': f'Right-size to {recommended_profile}',
                    'potential_savings': instance['cost'] * 0.5
                })

        # Analyze storage volumes
        for volume in self.usage_data.get('volumes', []):
            if not volume.get('attached_instances'):
                idle_resources['volumes'].append({
                    'id': volume['id'],
                    'name': volume['name'],
                    'size_gb': volume['size'],
                    'cost_per_month': volume['cost'],
                    'recommendation': 'Delete unused volume',
                    'potential_savings': volume['cost']
                })

        return idle_resources

    def optimize_storage_costs(self):
        """Optimize storage costs with lifecycle policies"""
        recommendations = []

        for bucket in self.usage_data.get('cos_buckets', []):
            # Analyze object age
            objects = bucket.get('objects', [])
            old_objects = [o for o in objects
                          if (datetime.now() - o['last_modified']).days > 90]

            if len(old_objects) > len(objects) * 0.3:  # >30% old objects
                total_size_gb = sum(o['size'] for o in old_objects) / (1024**3)
                current_cost = total_size_gb * 0.026  # Standard tier
                archive_cost = total_size_gb * 0.002  # Glacier tier
                savings = (current_cost - archive_cost) * 12  # Annual

                recommendations.append({
                    'bucket': bucket['name'],
                    'recommendation': 'Implement lifecycle policy to archive old objects',
                    'objects_to_archive': len(old_objects),
                    'size_gb': round(total_size_gb, 2),
                    'annual_savings': round(savings, 2)
                })

        return recommendations

    def recommend_reserved_capacity(self):
        """Recommend reserved capacity for predictable workloads"""
        recommendations = []

        # Analyze instance usage patterns
        long_running_instances = []
        for instance in self.usage_data.get('instances', []):
            uptime_days = instance.get('uptime_days', 0)

            if uptime_days > 720:  # Running for 2+ years
                monthly_cost = instance['cost']
                reserved_monthly = monthly_cost * 0.6  # 40% discount
                annual_savings = (monthly_cost - reserved_monthly) * 12

                recommendations.append({
                    'instance': instance['name'],
                    'profile': instance['profile'],
                    'current_monthly_cost': monthly_cost,
                    'reserved_monthly_cost': reserved_monthly,
                    'annual_savings': round(annual_savings, 2),
                    'recommendation': '1-year or 3-year reserved capacity'
                })

        return recommendations

    def generate_cost_report(self):
        """Generate comprehensive cost optimization report"""
        idle = self.identify_idle_resources()
        storage = self.optimize_storage_costs()
        reserved = self.recommend_reserved_capacity()

        total_potential_savings = 0

        # Calculate total savings from idle resources
        for category in idle.values():
            for resource in category:
                total_potential_savings += resource.get('potential_savings', 0)

        # Add storage savings
        for rec in storage:
            total_potential_savings += rec['annual_savings'] / 12

        # Add reserved capacity savings
        for rec in reserved:
            total_potential_savings += rec['annual_savings'] / 12

        return {
            'generated_at': datetime.now().isoformat(),
            'total_monthly_savings': round(total_potential_savings, 2),
            'total_annual_savings': round(total_potential_savings * 12, 2),
            'idle_resources': idle,
            'storage_optimization': storage,
            'reserved_capacity': reserved
        }

# Terraform for cost management
cost_mgmt_tf = '''
# cost-management.tf

# Budget alerts
resource "ibm_billing_budget" "monthly_budget" {
  name        = "Monthly Cloud Budget"
  amount      = 10000
  currency    = "USD"
  time_period = "monthly"
  threshold_percentage = 80

  notifications {
    email_addresses = ["finance@example.com", "cloudops@example.com"]
  }
}

# Resource quotas
resource "ibm_resource_quota" "dev_quota" {
  name              = "Development Environment Quota"
  resource_group_id = ibm_resource_group.dev.id

  quota {
    limit = 5
    resource_type = "instance"
  }

  quota {
    limit = 100
    resource_type = "storage_gb"
  }
}

# Tagging for cost allocation
resource "ibm_resource_tag" "cost_center" {
  resource_id = ibm_is_instance.app_server.id
  tags        = [
    "cost-center:engineering",
    "environment:production",
    "project:customer-portal",
    "owner:team-alpha"
  ]
}
'''