turbot/ibm

GitHub
steampipe plugin install ibmsteampipe plugin install ibm

IBM Cloud + Steampipe

IBM Cloud is a set of cloud computing services for business including IaaS and PaaS.

Steampipe is an open source CLI to instantly query cloud APIs using SQL.

List VPCs in your IBM Cloud account:

select
id,
name,
status,
region
from
ibm_is_vpc;
+-------------------------------------------+------+-----------+----------+
| id | name | status | region |
+-------------------------------------------+------+-----------+----------+
| r006-db18c7a8-0ccd-43eb-b9c1-4216c9206201 | prod | available | us-east |
| r006-c89bee10-d788-4cbe-bf45-dcb940d663a5 | dev | available | us-south |
+-------------------------------------------+------+-----------+----------+

Documentation

Get started

Install

Download and install the latest IBM Cloud plugin:

steampipe plugin install ibm

Credentials

ItemDescription
CredentialsCreate an API key from IBM Cloud console.
Permissions
  1. Viewer access for All Account Management Services
  2. Viewer access for All Identity and Access enabled services
RadiusEach connection represents a single IBM cloud account.
Resolution1. api_key in steampipe config.
2. IC_API_KEY environment variable.
3. IBMCLOUD_API_KEY environment variable.
Region Resolution1. Regions set for the connection via the regions argument in the config file (~/.steampipe/config/ibm.spc).
2. The region specified in the IC_REGION or IBMCLOUD_REGION environment variable.

Configuration

Installing the latest ibm plugin will create a config file (~/.steampipe/config/ibm.spc) with a single connection named ibm:

connection "ibm" {
plugin = "ibm"
# You may connect to one or more regions. If `regions` is not specified,
# Steampipe will use a single default region using:
# The `IC_REGION` or `IBMCLOUD_REGION` environment variable
# regions = ["us-south", "eu-de"]
# API Key from IBM Cloud
# api_key = "0hrqaLNt-Nc831AW5k7z10CcwOGk_ttqTpOSWYJ2rnwi"
}

Multi-Account Connections

You may create multiple IBM connections:

connection "ibm_dev" {
plugin = "ibm"
regions = ["us-south", "eu-de"]
api_key = "0hrqaLNt-Nc831AW5k7z10CcwOGk_ttqTpPOYYJ2rnwi"
}
connection "ibm_qa" {
plugin = "ibm"
regions = ["us-south", "eu-de"]
api_key = "0hrqaLNt-Nc831AW5k7z10CcwOGk_ttqTpBBTYJ2rnwi"
}
connection "ibm_prod" {
plugin = "ibm"
regions = ["us-south", "eu-de"]
api_key = "0hrqaLNt-Nc831AW5k7z10CcwOGk_ttqTpWRDYJ2rnwi"
}

Each connection is implemented as a distinct Postgres schema. As such, you can use qualified table names to query a specific connection:

select
*
from
ibm_qa.ibm_iam_user

You can create multi-account connections by using an aggregator connection. Aggregators allow you to query data from multiple connections for a plugin as if they are a single connection.

connection "ibm_all" {
plugin = "ibm"
type = "aggregator"
connections = ["ibm_dev", "ibm_qa", "ibm_prod"]
}

Querying tables from this connection will return results from the ibm_dev, ibm_qa, and ibm_prod connections:

select
*
from
ibm_all.ibm_iam_user

Alternatively, you can use an unqualified name and it will be resolved according to the Search Path. It's a good idea to name your aggregator first alphabetically so that it is the first connection in the search path (i.e. ibm_all comes before ibm_dev):

select
*
from
ibm_iam_user

Steampipe supports the * wildcard in the connection names. For example, to aggregate all the IBM plugin connections whose names begin with ibm_:

connection "ibm_all" {
type = "aggregator"
plugin = "ibm"
connections = ["ibm_*"]
}

Get involved

Multi-Region Connections

You may also specify one or more regions with the regions argument:

connection "ibm" {
plugin = "ibm"
regions = ["au-syd", "eu-de", "eu-gb", "jp-osa", "jp-tok", "us-east", "us-south"]
}

The region argument supports wildcards:

  • All regions

    connection "ibm" {
    plugin = "ibm"
    regions = ["*"]
    }
  • All US and EU regions

    connection "ibm" {
    plugin = "ibm"
    regions = ["us-*", "eu-*"]
    }

IBM multi-region connections are common, but be aware that performance may be impacted by the number of regions and the latency to them.

Configuring IBM Credentials

Credentials from Environment Variables

The IBM plugin will use the standard IBM environment variables to obtain credentials only if other arguments (api_key, regions) are not specified in the connection:

export IC_API_KEY=0hrqaLNt-Nc831AW5k7z10CcwOGk_ttqTpOSWYJ2rnwi
export IBMCLOUD_API_KEY=0hrqaLNt-Nc831AW5k7z10CcwOGk_ttqTpOSWYJ2rnwi
connection "ibm" {
plugin = "ibm"
}