refine comments and files names

config.sample.yaml

@@ -8,9 +8,9 @@ management:
   mgmt_storage_account_name: __CHANGE_ME__
   terraform_state_container_name: tfstate
   acr_name: __CHANGE_ME__
-  # ID of external Key Vault/HSM to store CMKs in (only required if enable_cmk_encryption is true)
+  # ID of external Key Vault to store CMKs in (only required if enable_cmk_encryption is true)
   # external_key_store_id: __CHANGE_ME__
-  # name of Key Vault for encryption keys, required only if enable_cmk_encryption is true and not using an external Key Vault/HSM
+  # name of Key Vault for encryption keys, required only if enable_cmk_encryption is true and not using external_key_store_id
   # encryption_kv_name: __CHANGE_ME__
   # Azure Resource Manager credentials used for CI/CD pipelines
   arm_subscription_id: __CHANGE_ME__

core/terraform/airlock/variables.tf

@@ -99,12 +99,12 @@ variable "encryption_identity_id" {
 
 variable "enable_cmk_encryption" {
   type        = bool
-  description = "A boolean indicating if key vault will be deployed for customer managed key encryption"
+  description = "A boolean indicating if customer managed keys will be used for encryption of supporting resources"
 }
 
 variable "key_store_id" {
   type        = string
-  description = "ID of the Key Vault/HSM to store CMKs in (only used if enable_cmk_encryption is true)"
+  description = "ID of the Key Vault to store CMKs in (only used if enable_cmk_encryption is true)"
   default     = null
 }
 

core/terraform/appgateway/variables.tf

@@ -38,11 +38,11 @@ variable "encryption_identity_id" {
 }
 variable "enable_cmk_encryption" {
   type        = bool
-  description = "A boolean indicating if key vault will be deployed for customer managed key encryption"
+  description = "A boolean indicating if customer managed keys will be used for encryption of supporting resources"
 }
 variable "key_store_id" {
   type        = string
-  description = "ID of the Key Vault/HSM to store CMKs in (only used if enable_cmk_encryption is true)"
+  description = "ID of the Key Vault to store CMKs in (only used if enable_cmk_encryption is true)"
   default     = null
 }
 variable "kv_encryption_key_name" {

core/terraform/azure-monitor/variables.tf

@@ -40,11 +40,11 @@ variable "encryption_identity_id" {
 }
 variable "enable_cmk_encryption" {
   type        = bool
-  description = "A boolean indicating if key vault will be deployed for customer managed key encryption"
+  description = "A boolean indicating if customer managed keys will be used for encryption of supporting resources"
 }
 variable "key_store_id" {
   type        = string
-  description = "ID of the Key Vault/HSM to store CMKs in (only used if enable_cmk_encryption is true)"
+  description = "ID of the Key Vault to store CMKs in (only used if enable_cmk_encryption is true)"
   default     = null
 }
 variable "kv_encryption_key_name" {

core/terraform/resource_processor/vmss_porter/variables.tf

@@ -82,12 +82,12 @@ locals {
 
 variable "enable_cmk_encryption" {
   type        = bool
-  description = "A boolean indicating if key vault will be deployed for customer managed key encryption"
+  description = "A boolean indicating if customer managed keys will be used for encryption of supporting resources"
 }
 
 variable "key_store_id" {
   type        = string
-  description = "ID of the Key Vault/HSM to store CMKs in (only used if enable_cmk_encryption is true)"
+  description = "ID of the Key Vault to store CMKs in (only used if enable_cmk_encryption is true)"
   default     = null
 }
 

core/terraform/statestore.tf

@@ -27,7 +27,7 @@ resource "azurerm_cosmosdb_account" "tre_db_account" {
     failover_priority = 0
   }
 
-  lifecycle { ignore_changes = [tags, key_vault_key_id] }
+  lifecycle { ignore_changes = [tags] }
 }
 
 moved {

core/terraform/variables.tf

@@ -226,13 +226,13 @@ variable "logging_level" {
 
 variable "enable_cmk_encryption" {
   type        = bool
-  description = "A boolean indicating if key vault will be deployed for customer managed key encryption"
+  description = "A boolean indicating if customer managed keys will be used for encryption of supporting resources"
   default     = false
 }
 
 variable "external_key_store_id" {
   type        = string
-  description = "ID of external Key Vault/HSM to store CMKs in (only required if enable_cmk_encryption is true)"
+  description = "ID of external Key Vault to store CMKs in (only required if enable_cmk_encryption is true)"
   default     = null
 }
 

devops/terraform/main.tf

@@ -41,7 +41,6 @@ resource "azurerm_storage_account" "state_storage" {
   lifecycle { ignore_changes = [tags] }
 }
 
-# CMK encryption for state storage account
 resource "azurerm_storage_account_customer_managed_key" "state_storage_encryption" {
   count                     = var.enable_cmk_encryption ? 1 : 0
   storage_account_id        = azurerm_storage_account.state_storage.id
@@ -110,8 +109,6 @@ resource "azurerm_key_vault" "encryption_kv" {
   sku_name                    = "standard"
   tenant_id                   = data.azurerm_client_config.current.tenant_id
   enable_rbac_authorization   = true
-
-  # Purge protection needs to be enabled for customer managed key encryption
   purge_protection_enabled = true
 
   lifecycle { ignore_changes = [tags] }

devops/terraform/variables.tf

@@ -32,13 +32,13 @@ variable "kv_purge_protection_enabled" {
 
 variable "enable_cmk_encryption" {
   type        = bool
-  description = "A boolean indicating if key vault will be deployed for customer managed key encryption"
+  description = "A boolean indicating if customer managed keys will be used for encryption of supporting resources"
   default     = false
 }
 
 variable "external_key_store_id" {
   type        = string
-  description = "ID of external Key Vault/HSM to store CMKs in (only required if enable_cmk_encryption is true)"
+  description = "ID of external Key Vault to store CMKs in (only required if enable_cmk_encryption is true)"
   default     = null
 }