terraform-azurerm-avm-res-keyvault-vault

Module to deploy key vaults, keys and secrets in Azure.

Requirements

The following requirements are needed by this module:

• terraform (>= 1.11, < 2.0)

• azapi (~> 2.4)

• azurerm (>= 4.81, < 5.2)

• modtm (~> 0.3)

• random (~> 3.5)

• time (~> 0.9)

Resources

The following resources are used by this module:

• azurerm_key_vault.this (resource)
• azurerm_key_vault_access_policy.this (resource)
• azurerm_key_vault_certificate_contacts.this (resource)
• azurerm_management_lock.private_endpoints (resource)
• azurerm_management_lock.private_endpoints_unmanaged_dns_zone_groups (resource)
• azurerm_management_lock.this (resource)
• azurerm_monitor_diagnostic_setting.this (resource)
• azurerm_private_endpoint.this (resource)
• azurerm_private_endpoint.this_unmanaged_dns_zone_groups (resource)
• azurerm_private_endpoint_application_security_group_association.this (resource)
• azurerm_role_assignment.this (resource)
• modtm_telemetry.telemetry (resource)
• random_uuid.telemetry (resource)
• time_sleep.wait_for_rbac_before_contact_operations (resource)
• time_sleep.wait_for_rbac_before_key_operations (resource)
• time_sleep.wait_for_rbac_before_secret_operations (resource)
• azapi_client_config.telemetry (data source)
• modtm_module_source.telemetry (data source)

Required Inputs

The following input variables are required:

location

Description: The Azure location where the resources will be deployed.

Type: string

name

Description: The name of the Key Vault.

Type: string

resource_group_name

Description: The resource group where the resources will be deployed.

Type: string

tenant_id

Description: The Azure tenant ID used for authenticating requests to Key Vault. You can use the azurerm_client_config data source to retrieve it.

Type: string

Optional Inputs

The following input variables are optional (have default values):

contacts

Description: A map of contacts for the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

Type:

map(object({
    email = string
    name  = optional(string, null)
    phone = optional(string, null)
  }))

Default: {}

diagnostic_settings

Description: A map of diagnostic settings to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

• name - (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.
• log_categories - (Optional) A set of log categories to send to the log analytics workspace. Defaults to [].
• log_groups - (Optional) A set of log groups to send to the log analytics workspace. Defaults to ["allLogs"].
• metric_categories - (Optional) A set of metric categories to send to the log analytics workspace. Defaults to ["AllMetrics"].
• log_analytics_destination_type - (Optional) The destination type for the diagnostic setting. Possible values are Dedicated and AzureDiagnostics. Defaults to Dedicated.
• workspace_resource_id - (Optional) The resource ID of the log analytics workspace to send logs and metrics to.
• storage_account_resource_id - (Optional) The resource ID of the storage account to send logs and metrics to.
• event_hub_authorization_rule_resource_id - (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.
• event_hub_name - (Optional) The name of the event hub. If none is specified, the default event hub will be selected.
• marketplace_partner_resource_id - (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic LogsLogs.

Type:

map(object({
    name                                     = optional(string, null)
    log_categories                           = optional(set(string), [])
    log_groups                               = optional(set(string), ["allLogs"])
    metric_categories                        = optional(set(string), ["AllMetrics"])
    log_analytics_destination_type           = optional(string, "Dedicated")
    workspace_resource_id                    = optional(string, null)
    storage_account_resource_id              = optional(string, null)
    event_hub_authorization_rule_resource_id = optional(string, null)
    event_hub_name                           = optional(string, null)
    marketplace_partner_resource_id          = optional(string, null)
  }))

Default: {}

enable_telemetry

Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.

Type: bool

Default: true

enabled_for_deployment

Description: Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the vault.

Type: bool

Default: false

enabled_for_disk_encryption

Description: Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.

Type: bool

Default: false

enabled_for_template_deployment

Description: Specifies whether Azure Resource Manager is permitted to retrieve secrets from the vault.

Type: bool

Default: false

keys

Description: A map of keys to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

• name - The name of the key.
• key_type - The type of the key. Possible values are EC, EC-HSM, RSA, and RSA-HSM. The values are case-sensitive. The HSM-backed types (EC-HSM and RSA-HSM) require var.sku_name to be set to premium.
• key_opts - A list of key options. Possible values are decrypt, encrypt, sign, unwrapKey, verify, and wrapKey.
• key_size - The size of the key, e.g. 2048 or 4096. Required for RSA and RSA-HSM keys.
• curve - The curve of the key. Required for EC and EC-HSM keys. Possible values are P-256, P-256K, P-384, and P-521. The API will default to P-256 if nothing is specified.
• not_before_date - The not before date of the key.
• expiration_date - The expiration date of the key.
• tags - A mapping of tags to assign to the key.
• rotation_policy - The rotation policy of the key.
  • automatic - The automatic rotation policy of the key.
    • time_after_creation - The time after creation of the key before it is automatically rotated.
    • time_before_expiry - The time before expiry of the key before it is automatically rotated.
  • expire_after - The time after which the key expires.
  • notify_before_expiry - The time before expiry of the key when notification emails will be sent.

Supply role assignments in the same way as for var.role_assignments.

Type:

map(object({
    name     = string
    key_type = string
    key_opts = optional(list(string), ["sign", "verify"])

    key_size        = optional(number, null)
    curve           = optional(string, null)
    not_before_date = optional(string, null)
    expiration_date = optional(string, null)
    tags            = optional(map(any), null)

    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})

    rotation_policy = optional(object({
      automatic = optional(object({
        time_after_creation = optional(string, null)
        time_before_expiry  = optional(string, null)
      }), null)
      expire_after         = optional(string, null)
      notify_before_expiry = optional(string, null)
    }), null)
  }))

Default: {}

legacy_access_policies

Description: A map of legacy access policies to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

Requires var.legacy_access_policies_enabled to be true.

• object_id - (Required) The object ID of the principal to assign the access policy to.
• application_id - (Optional) The object ID of an Application in Azure Active Directory. Changing this forces a new resource to be created.
• certifiate_permissions - (Optional) A list of certificate permissions. Possible values are: Backup, Create, Delete, DeleteIssuers, Get, GetIssuers, Import, List, ListIssuers, ManageContacts, ManageIssuers, Purge, Recover, Restore, SetIssuers, and Update.
• key_permissions - (Optional) A list of key permissions. Possible value are: Backup, Create, Decrypt, Delete, Encrypt, Get, Import, List, Purge, Recover, Restore, Sign, UnwrapKey, Update, Verify, WrapKey, Release, Rotate, GetRotationPolicy, and SetRotationPolicy.
• secret_permissions - (Optional) A list of secret permissions. Possible values are: Backup, Delete, Get, List, Purge, Recover, Restore, and Set.
• storage_permissions - (Optional) A list of storage permissions. Possible values are: Backup, Delete, DeleteSAS, Get, GetSAS, List, ListSAS, Purge, Recover, RegenerateKey, Restore, Set, SetSAS, and Update.

Type:

map(object({
    object_id               = string
    application_id          = optional(string, null)
    certificate_permissions = optional(set(string), [])
    key_permissions         = optional(set(string), [])
    secret_permissions      = optional(set(string), [])
    storage_permissions     = optional(set(string), [])
  }))

Default: {}

legacy_access_policies_enabled

Description: Specifies whether legacy access policies are enabled for this Key Vault. Prevents use of Azure RBAC for data plane.

Type: bool

Default: false

lock

Description: Controls the Resource Lock configuration for the Key Vault. Omit it, or set it to null, to create no lock.

• kind - (Required) The type of lock. Possible values are CanNotDelete and ReadOnly.
• name - (Optional) The name of the lock. One is generated from the Key Vault name if not set. Changing this forces the creation of a new resource.

Type:

object({
    kind = string
    name = optional(string, null)
  })

Default: null

network_acls

Description: The network ACL configuration for the Key Vault.
If not specified then the Key Vault will be created with a firewall that blocks access.
Specify null to create the Key Vault with no firewall.

• bypass - (Optional) Should Azure Services bypass the ACL. Possible values are AzureServices and None. Defaults to None.
• default_action - (Optional) The default action when no rule matches. Possible values are Allow and Deny. Defaults to Deny.
• ip_rules - (Optional) A list of IP rules in CIDR format. Defaults to [].
• virtual_network_subnet_ids - (Optional) When using with Service Endpoints, a list of subnet IDs to associate with the Key Vault. Defaults to [].

Type:

object({
    bypass                     = optional(string, "None")
    default_action             = optional(string, "Deny")
    ip_rules                   = optional(list(string), [])
    virtual_network_subnet_ids = optional(list(string), [])
  })

Default: {}

private_endpoints

Description: A map of private endpoints to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

• name - (Optional) The name of the private endpoint. One will be generated if not set.
• role_assignments - (Optional) A map of role assignments to create on the private endpoint. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time. See var.role_assignments for more information.
• lock - (Optional) The lock to apply to the private endpoint. Omit it, or set it to null, to create no lock.
  • kind - (Required) The type of lock. Possible values are CanNotDelete and ReadOnly.
  • name - (Optional) The name of the lock. One is generated from the private endpoint name if not set. Changing this forces the creation of a new resource.
• tags - (Optional) A mapping of tags to assign to the private endpoint.
• subnet_resource_id - The resource ID of the subnet to deploy the private endpoint in.
• private_dns_zone_group_name - (Optional) The name of the private DNS zone group. One will be generated if not set.
• private_dns_zone_resource_ids - (Optional) A set of resource IDs of private DNS zones to associate with the private endpoint. If not set, no zone groups will be created and the private endpoint will not be associated with any private DNS zones. DNS records must be managed external to this module.
• application_security_group_associations - (Optional) A map of resource IDs of application security groups to associate with the private endpoint. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
• private_service_connection_name - (Optional) The name of the private service connection. One will be generated if not set.
• network_interface_name - (Optional) The name of the network interface. One will be generated if not set.
• location - (Optional) The Azure location where the resources will be deployed. Defaults to the location of the resource group.
• resource_group_name - (Optional) The resource group where the resources will be deployed. Defaults to the resource group of the Key Vault.
• ip_configurations - (Optional) A map of IP configurations to create on the private endpoint. If not specified the platform will create one. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
  • name - The name of the IP configuration.
  • private_ip_address - The private IP address of the IP configuration.

Type:

map(object({
    name = optional(string, null)
    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
    lock = optional(object({
      kind = string
      name = optional(string, null)
    }), null)
    tags                                    = optional(map(string), null)
    subnet_resource_id                      = string
    private_dns_zone_group_name             = optional(string, "default")
    private_dns_zone_resource_ids           = optional(set(string), [])
    application_security_group_associations = optional(map(string), {})
    private_service_connection_name         = optional(string, null)
    network_interface_name                  = optional(string, null)
    location                                = optional(string, null)
    resource_group_name                     = optional(string, null)
    ip_configurations = optional(map(object({
      name               = string
      private_ip_address = string
    })), {})
  }))

Default: {}

private_endpoints_manage_dns_zone_group

Description: Whether to manage private DNS zone groups with this module. If set to false, you must manage private DNS zone groups externally, e.g. using Azure Policy.

Type: bool

Default: true

public_network_access_enabled

Description: Specifies whether public access is permitted.

Type: bool

Default: true

purge_protection_enabled

Description: Specifies whether protection against purge is enabled for this Key Vault. Note once enabled this cannot be disabled.

Type: bool

Default: true

role_assignments

Description: A map of role assignments to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

• role_definition_id_or_name - The ID or name of the role definition to assign to the principal.
• principal_id - The ID of the principal to assign the role to.
• description - The description of the role assignment.
• skip_service_principal_aad_check - If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.
• condition - The condition which will be used to scope the role assignment.
• condition_version - The version of the condition syntax. If you are using a condition, valid values are '2.0'.

Note: only set skip_service_principal_aad_check to true if you are assigning a role to a service principal.

Type:

map(object({
    role_definition_id_or_name             = string
    principal_id                           = string
    description                            = optional(string, null)
    skip_service_principal_aad_check       = optional(bool, false)
    condition                              = optional(string, null)
    condition_version                      = optional(string, null)
    delegated_managed_identity_resource_id = optional(string, null)
    principal_type                         = optional(string, null)
  }))

Default: {}

secrets

Description: A map of secrets to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.

• name - The name of the secret.
• content_type - The content type of the secret.
• tags - A mapping of tags to assign to the secret.
• not_before_date - The not before date of the secret.
• expiration_date - The expiration date of the secret.

Supply role assignments in the same way as for var.role_assignments.

Note: the value of the secret is supplied via the var.secrets_value variable, or via var.secrets_value_wo and var.secrets_value_wo_version for a write-only value. Make sure to use the same map key.

Type:

map(object({
    name            = string
    content_type    = optional(string, null)
    tags            = optional(map(any), null)
    not_before_date = optional(string, null)
    expiration_date = optional(string, null)

    role_assignments = optional(map(object({
      role_definition_id_or_name             = string
      principal_id                           = string
      description                            = optional(string, null)
      skip_service_principal_aad_check       = optional(bool, false)
      condition                              = optional(string, null)
      condition_version                      = optional(string, null)
      delegated_managed_identity_resource_id = optional(string, null)
      principal_type                         = optional(string, null)
    })), {})
  }))

Default: {}

secrets_value

Description: A map of secret keys to values.
The map key is the supplied input to var.secrets.
The map value is the secret value.

This is a separate variable to var.secrets because it is sensitive and therefore cannot be used in a for_each loop.

Type: map(string)

Default: {}

secrets_value_wo

Description: A map of secret keys to writable-only secret values.
The map key is the supplied input to var.secrets.
The map value is the writable-only secret value for that key.

Use var.secrets_value_wo_version with the same key to control updates when the writable-only value changes.

Type: map(string)

Default: null

secrets_value_wo_version

Description: A map of secret keys to writable-only secret value versions.
The map key is the supplied input to var.secrets.
The map value is the version identifier for that secret value.

Use the same key as var.secrets_value_wo; increment the version when the corresponding writable-only value changes to trigger a secret update.

Type: map(number)

Default: null

sku_name

Description: The SKU name of the Key Vault. Default is premium. Possible values are standard and premium.

Type: string

Default: "premium"

soft_delete_retention_days

Description: The number of days that items should be retained for once soft-deleted. This value can be between 7 and 90 (the default) days.

Type: number

Default: null

tags

Description: Map of tags to assign to the Key Vault resource.

Type: map(string)

Default: null

wait_for_rbac_before_contact_operations

Description: This variable controls the amount of time to wait before performing contact operations.
It only applies when var.role_assignments and var.contacts are both set.
This is useful when you are creating role assignments on the key vault and immediately creating keys in it.
The default is 30 seconds for create and 0 seconds for destroy.

Type:

object({
    create  = optional(string, "30s")
    destroy = optional(string, "0s")
  })

Default: {}

wait_for_rbac_before_key_operations

Description: This variable controls the amount of time to wait before performing key operations.
It only applies when var.role_assignments and var.keys are both set.
This is useful when you are creating role assignments on the key vault and immediately creating keys in it.
The default is 30 seconds for create and 0 seconds for destroy.

Type:

object({
    create  = optional(string, "30s")
    destroy = optional(string, "0s")
  })

Default: {}

wait_for_rbac_before_secret_operations

Description: This variable controls the amount of time to wait before performing secret operations.
It only applies when var.role_assignments and var.secrets are both set.
This is useful when you are creating role assignments on the key vault and immediately creating secrets in it.
The default is 30 seconds for create and 0 seconds for destroy.

Type:

object({
    create  = optional(string, "30s")
    destroy = optional(string, "0s")
  })

Default: {}

Outputs

The following outputs are exported:

keys

Description: A map of key keys to key values. The map key is the key of the var.keys map entry (not
the name of the key itself). The key value is not the entire azurerm_key_vault_key
resource, only the attributes listed below are exposed.

The key value contains the following attributes, grouped by purpose:

Identifiers:

• id: The versioned data plane URI of the key, in the form https://<vault-name>.vault.azure.net/keys/<key-name>/<key-version>. This is the value most Azure services expect for a customer managed key.
• name: The name of the key.
• versionless_id: The versionless data plane URI of the key, in the form https://<vault-name>.vault.azure.net/keys/<key-name>. Use only where the consuming API documents that it accepts a versionless URI; supporting rotation does not imply this.
• resource_id: The versioned ARM resource ID of the key, in the form /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<vault-name>/keys/<key-name>/versions/<key-version>.
• resource_versionless_id: The versionless ARM resource ID of the key, in the form /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<vault-name>/keys/<key-name>.

Encoded public key, for RSA and for EC curves other than P-256K:

• public_key_pem: The PEM encoded public key of the key.
• public_key_openssh: The OpenSSH encoded public key of the key.

Raw RSA public key components, empty for EC keys. These are a pair:

• n: The RSA modulus of the key.
• e: The RSA public exponent of the key.

Raw EC public key components, empty for RSA keys. These are a pair:

• x: The EC X component of the key.
• y: The EC Y component of the key.

For example, to pass a key to a service that expects a key vault key URI: module.key_vault.keys["<var.keys map key>"].id

keys_resource_ids

Description: A map of key keys to resource ids and key names. The map key is the key of the var.keys
map entry (not the name of the key itself). See the keys output for the exact shape of
each attribute: id and versionless_id are data plane URIs, resource_id and resource_versionless_id are ARM resource IDs.

name

Description: The name of the key vault.

private_endpoints

Description: A map of private endpoints. The map key is the supplied input to var.private_endpoints. The map value is the entire azurerm_private_endpoint resource.

resource_id

Description: The Azure resource id of the key vault.

secrets

Description: A map of secret keys to secret values. The map key is the key of the var.secrets map
entry (not the name of the secret itself). The secret value is not the entire
azurerm_key_vault_secret resource, only the attributes listed below are exposed.

The secret value contains the following attributes:

• id: The versioned data plane URI of the secret, in the form https://<vault-name>.vault.azure.net/secrets/<secret-name>/<secret-version>.
• name: The name of the secret.
• versionless_id: The versionless data plane URI of the secret, in the form https://<vault-name>.vault.azure.net/secrets/<secret-name>.
• resource_id: The versioned ARM resource ID of the secret, in the form /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<vault-name>/secrets/<secret-name>/versions/<secret-version>.
• resource_versionless_id: The versionless ARM resource ID of the secret, in the form /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.KeyVault/vaults/<vault-name>/secrets/<secret-name>.

secrets_resource_ids

Description: A map of secret keys to resource ids and secret names. The map key is the key of the var.secrets map entry (not the name of the secret itself). See the secrets output for
the exact shape of each attribute: id and versionless_id are data plane URIs, resource_id and resource_versionless_id are ARM resource IDs.

uri

Description: The URI of the vault for performing operations on keys and secrets

Modules

The following Modules are called:

keys

Source: ./modules/key

Version:

secrets

Source: ./modules/secret

Version:

Data Collection

The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.