Add support for creating service credentials with private endpoint in Event Streams

[prakash-ibm]

Description

Event Streams supports creating service credentials for both public and private endpoints. However, the current Terraform module only supports creating service credentials for public endpoints. Support is needed to allow creation of service credentials for private endpoints as well.

Note: This is not about creating a service_endpoint on the instance itself, but about generating service credentials that are scoped to either public or private endpoints.

Currently, service credential creation in this module is handled using the following block:

resource "ibm_resource_key" "service_credentials" {
for_each = var.service_credential_names
name = each.key
role = each.value
resource_instance_id = ibm_resource_instance.es_instance.id
}

This creates credentials for the public endpoint by default. According to the Terraform documentation, specifying the parameters block with the appropriate value (e.g., {"service-endpoints": "private"}) allows the creation of service credentials for private endpoints.

The module should be updated to support passing the parameters argument to enable private endpoint service credentials.

New or affected modules

---

By submitting this issue, you agree to follow our Code of Conduct

[Khuzaima05]

@prakash-ibm

We have done testing

• Lite/Standard Plan: Supports only public service endpoints; setting credentials endpoint to private fails.
• Enterprise Plan: Supports both public and private service endpoints , but service and credentials endpoints must match.
• Omitting service_credentials_endpoints defaults to the same type as the service endpoint.

Based on the testing results, adding a separate service_credentials_endpoints variable is not functionally necessary for Event Streams. When the module already defines service_endpoints for the Event Streams instance, the service credentials automatically inherit the same endpoint type (public or private). Specifying service_credentials_endpoints explicitly does not change the behavior — it only provides configuration clarity or explicit control.
In short, credentials will align with the instance’s service_endpoints by default, so the additional variable is optional, not required.

[prakash-ibm]

@Khuzaima05 When I was trying to provision an EventStreams instance using service_endpoints = "public-and-private" along with the enterprise-3nodes-2tb plan, I noticed that the service credentials were generated only for the public endpoint. But we need credentials for the private endpoint as well.

According to the Terraform documentation, to create a private endpoint, need to pass the parameters argument with service_endpoints = "private". I reviewed the code but couldn’t find this parameter being set, so I’m unsure if I missed something.
Below are the inputs that were passed to Terraform during provisioning. Could you please review and let me know if anything is missing?

  resource_group_id = dependency.resource_group.outputs.resource_group_id
  es_name           = "enterprise-eventstreams-${local.environment}"
  region            = "${local.region}"
  plan              = "enterprise-3nodes-2tb"
  service_endpoints = "public-and-private"
  tags              = "${local.common_tags}"
  service_credential_names = {
    "public-key" : "Manager"
  }

Due to a recent reorg, I’ve moved to a different team. I’m tagging the relevant person for further assistance.
cc: @bryan.duggan@ibm.com @bencourliss@ibm.com @anoop.sasi@ibm.com

[Khuzaima05]

Thanks @prakash-ibm , I will test the exact scenario which you mentioned and will update the module accordingly if needed.