Terraform AZURE KEY-VAULT

Terraform module to create key-vault resource on AZURE.

---

We eat, drink, sleep and most importantly love DevOps. We are working towards strategies for standardizing architecture while ensuring security for the infrastructure. We are strong believer of the philosophy Bigger problems are always solved by breaking them into smaller manageable problems. Resonating with microservices architecture, it is considered best-practice to run database, cluster, storage in smaller connected yet manageable pieces within the infrastructure.

This module is basically combination of Terraform open source and includes automatation tests and examples. It also helps to create and improve your infrastructure with minimalistic code instead of maintaining the whole infrastructure code yourself.

We have fifty plus terraform modules. A few of them are comepleted and are available for open source usage while a few others are in progress.

Prerequisites

This module has a few dependencies:

• Terraform 1.x.x
• Go
• github.com/stretchr/testify/assert
• github.com/gruntwork-io/terratest/modules/terraform

Examples

IMPORTANT: Since the master branch used in source varies based on new modifications, we suggest that you use the release versions here.

Simple Example

Here is an example of how you can use this module in your inventory structure:

key-vault with access policy

module "key_vault" {
 source                      = "clouddrove/key-vault/azure"
 name                        = "annkkdsovvdcc"
 environment                 = "test"
 label_order                 = ["name", "environment", ]
 resource_group_name         = module.resource_group.resource_group_name
 purge_protection_enabled    = false
 enabled_for_disk_encryption = true
 sku_name                    = "standard"
 subnet_id                   = module.vnet.vnet_subnets[0]
 virtual_network_id          = module.vnet.vnet_id[0]
 #private endpoint
 enable_private_endpoint     = true
 #access_policy
 access_policy               = [{}]
 }

key-vault with RBAC

module "key_vault" {
source                      = "clouddrove/key-vault/azure"
name                        = "annkkdsovvdcc"
environment                 = "test"
label_order                 = ["name", "environment", ]
resource_group_name         = module.resource_group.resource_group_name
purge_protection_enabled    = false
enabled_for_disk_encryption = true
sku_name                    = "standard"
subnet_id                   = module.vnet.vnet_subnets[0]
virtual_network_id          = module.vnet.vnet_id[0]
#private endpoint
enable_private_endpoint     = true
##RBAC
enable_rbac_authorization   = true
principal_id                = ["71d1XXXXXXXXXXXXX166d7c97", "2fa59XXXXXXXXXXXXXX82716fb05"]
role_definition_name        = ["Key Vault Administrator", ]
}

Inputs

Name	Description	Type	Default	Required
access_policies	Map of access policies for an object_id (user, service principal, security group) to backend.	list(object({ object_id = string, certificate_permissions = list(string), key_permissions = list(string), secret_permissions = list(string), storage_permissions = list(string), }))	[]	no
access_policy	Map of access policies for an object_id (user, service principal, security group) to backend.	list(object({ object_id = string, certificate_permissions = list(string), key_permissions = list(string), secret_permissions = list(string), storage_permissions = list(string), }))	[]	no
addon_resource_group_name	The name of the addon vnet resource group	string	""	no
addon_vent_link	The name of the addon vnet	bool	false	no
addon_virtual_network_id	The name of the addon vnet link vnet id	string	""	no
enable_private_endpoint	Manages a Private Endpoint to Azure database for MySQL	bool	true	no
enable_rbac_authorization	(Optional) Boolean flag to specify whether Azure Key Vault uses Role Based Access Control (RBAC) for authorization of data actions.	bool	false	no
enabled	Set to false to prevent the module from creating any resources.	bool	true	no
enabled_for_disk_encryption	Boolean flag to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys. Defaults to false	bool	null	no
environment	Environment (e.g. prod, dev, staging).	string	""	no
existing_private_dns_zone	Name of the existing private DNS zone	string	null	no
existing_private_dns_zone_resource_group_name	The name of the existing resource group	string	""	no
label_order	Label order, e.g. sequence of application name and environment name,environment,'attribute' [webserver,qa,devops,public,] .	list(any)	[]	no
managedby	ManagedBy, eg ''.	string	""	no
name	Name (e.g. app or cluster).	string	""	no
network_acls_bypass	Specifies which traffic can bypass the network rules. Possible values are AzureServices and None.	string	null	no
network_acls_default_action	The Default Action to use when no rules match from ip_rules / virtual_network_subnet_ids. Possible values are Allow and Deny.	string	"Deny"	no
network_acls_ip_rules	(Optional) One or more IP Addresses, or CIDR Blocks which should be able to access the Key Vault.	list(string)	null	no
network_acls_subnet_ids	(Optional) One or more Subnet ID's which should be able to access this Key Vault.	list(string)	null	no
principal_id	The ID of the Principal (User, Group or Service Principal) to assign the Role Definition to. Changing this forces a new resource to be created.	list(string)	[]	no
public_network_access_enabled	(Optional) Whether public network access is allowed for this Key Vault. Defaults to true	bool	true	no
purge_protection_enabled	Is Purge Protection enabled for this Key Vault? Defaults to false	bool	null	no
repository	Terraform current module repo	string	""	no
resource_group_name	A container that holds related resources for an Azure solution	string	""	no
role_definition_name	The name of a built-in Role. Changing this forces a new resource to be created. Conflicts with role_definition_id	list(string)	[]	no
secrets	List of secrets for be created	map	{}	no
sku_name	The Name of the SKU used for this Key Vault. Possible values are standard and premium	string	"standard"	no
soft_delete_retention_days	The number of days that items should be retained for once soft-deleted. The valid value can be between 7 and 90 days	number	90	no
subnet_id	The resource ID of the subnet	string	""	no
tags	A map of tags to add to all resources	map(string)	{}	no
virtual_network_id	The name of the virtual network	string	""	no
virtual_network_name	The name of the virtual network	string	""	no

Outputs

Name	Description
id	n/a
vault_uri	n/a

Testing

In this module testing is performed with terratest and it creates a small piece of infrastructure, matches the output like ARN, ID and Tags name etc and destroy infrastructure in your AWS account. This testing is written in GO, so you need a GO environment in your system.

You need to run the following command in the testing folder:

  go test -run Test

Feedback

If you come accross a bug or have any feedback, please log it in our issue tracker, or feel free to drop us an email at hello@clouddrove.com.

If you have found it worth your time, go ahead and give us a ★ on our GitHub!

About us

At CloudDrove, we offer expert guidance, implementation support and services to help organisations accelerate their journey to the cloud. Our services include docker and container orchestration, cloud migration and adoption, infrastructure automation, application modernisation and remediation, and performance engineering.

We are The Cloud Experts!

---

We ❤️ Open Source and you can check out our other modules to get help with your new Cloud ideas.