Module to deploy key vaults, keys and secrets in Azure.
The following requirements are needed by this module:
The following providers are used by this module:
The following resources are used by this module:
- azurerm_key_vault.this (resource)
- azurerm_key_vault_key.this (resource)
- azurerm_key_vault_secret.this (resource)
- azurerm_management_lock.this (resource)
- azurerm_monitor_diagnostic_setting.this (resource)
- azurerm_private_endpoint.this (resource)
- azurerm_private_endpoint_application_security_group_association.this (resource)
- azurerm_resource_group_template_deployment.telemetry (resource)
- azurerm_role_assignment.keys (resource)
- azurerm_role_assignment.secrets (resource)
- azurerm_role_assignment.this (resource)
- random_id.telemetry (resource)
- time_sleep.wait_for_rbac_before_key_operations (resource)
- time_sleep.wait_for_rbac_before_secret_operations (resource)
- azurerm_client_config.this (data source)
- azurerm_resource_group.parent (data source)
The following input variables are required:
Description: The name of the Key Vault.
Type: string
Description: The resource group where the resources will be deployed.
Type: string
The following input variables are optional (have default values):
Description: A map of contacts for the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
Type:
map(object({
email = string
name = optional(string, null)
phone = optional(string, null)
}))
Default: {}
Description: A map of diagnostic settings to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
name
- (Optional) The name of the diagnostic setting. One will be generated if not set, however this will not be unique if you want to create multiple diagnostic setting resources.log_categories
- (Optional) A set of log categories to send to the log analytics workspace. Defaults to[]
.log_groups
- (Optional) A set of log groups to send to the log analytics workspace. Defaults to["allLogs"]
.metric_categories
- (Optional) A set of metric categories to send to the log analytics workspace. Defaults to["AllMetrics"]
.log_analytics_destination_type
- (Optional) The destination type for the diagnostic setting. Possible values areDedicated
andAzureDiagnostics
. Defaults toDedicated
.workspace_resource_id
- (Optional) The resource ID of the log analytics workspace to send logs and metrics to.storage_account_resource_id
- (Optional) The resource ID of the storage account to send logs and metrics to.event_hub_authorization_rule_resource_id
- (Optional) The resource ID of the event hub authorization rule to send logs and metrics to.event_hub_name
- (Optional) The name of the event hub. If none is specified, the default event hub will be selected.marketplace_partner_resource_id
- (Optional) The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic LogsLogs.
Type:
map(object({
name = optional(string, null)
log_categories = optional(set(string), [])
log_groups = optional(set(string), ["allLogs"])
metric_categories = optional(set(string), ["AllMetrics"])
log_analytics_destination_type = optional(string, "Dedicated")
workspace_resource_id = optional(string, null)
storage_account_resource_id = optional(string, null)
event_hub_authorization_rule_resource_id = optional(string, null)
event_hub_name = optional(string, null)
marketplace_partner_resource_id = optional(string, null)
}))
Default: {}
Description: This variable controls whether or not telemetry is enabled for the module.
For more information see https://aka.ms/avm/telemetryinfo.
If it is set to false, then no telemetry will be collected.
Type: bool
Default: true
Description: Specifies whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the vault.
Type: bool
Default: false
Description: Specifies whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
Type: bool
Default: false
Description: Specifies whether Azure Resource Manager is permitted to retrieve secrets from the vault.
Type: bool
Default: false
Description: A map of keys to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
name
- The name of the key.key_type
- The type of the key. Possible values areEC
andRSA
.key_opts
- A list of key options. Possible values aredecrypt
,encrypt
,sign
,unwrapKey
,verify
, andwrapKey
.key_size
- The size of the key. Required forRSA
keys.curve
- The curve of the key. Required forEC
keys. Possible values areP-256
,P-256K
,P-384
, andP-521
. The API will default toP-256
if nothing is specified.not_before_date
- The not before date of the key.expiration_date
- The expiration date of the key.tags
- A mapping of tags to assign to the key.rotation_policy
- The rotation policy of the key.automatic
- The automatic rotation policy of the key.time_after_creation
- The time after creation of the key before it is automatically rotated.time_before_expiry
- The time before expiry of the key before it is automatically rotated.
expire_after
- The time after which the key expires.notify_before_expiry
- The time before expiry of the key when notification emails will be sent.
Supply role assignments in the same way as for var.role_assignments
.
Type:
map(object({
name = string
key_type = string
key_opts = optional(list(string), ["sign", "verify"])
key_size = optional(number, null)
curve = optional(string, null)
not_before_date = optional(string, null)
expiration_date = optional(string, null)
tags = optional(map(any), null)
role_assignments = optional(map(object({
role_definition_id_or_name = string
principal_id = string
description = optional(string, null)
skip_service_principal_aad_check = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
delegated_managed_identity_resource_id = optional(string, null)
})), {})
rotation_policy = optional(object({
automatic = optional(object({
time_after_creation = optional(string, null)
time_before_expiry = optional(string, null)
}), null)
expire_after = optional(string, null)
notify_before_expiry = optional(string, null)
}), null)
}))
Default: {}
Description: Azure region where the resource should be deployed.
If null, the location will be inferred from the resource group location.
Type: string
Default: null
Description: The lock level to apply to the Key Vault. Default is None
. Possible values are None
, CanNotDelete
, and ReadOnly
.
Type:
object({
name = optional(string, null)
kind = optional(string, "None")
})
Default: {}
Description: The network ACL configuration for the Key Vault.
If not specified then the Key Vault will be created with a firewall that blocks access.
Specify null
to create the Key Vault with no firewall.
bypass
- (Optional) Should Azure Services bypass the ACL. Possible values areAzureServices
andNone
. Defaults toNone
.default_action
- (Optional) The default action when no rule matches. Possible values areAllow
andDeny
. Defaults toDeny
.ip_rules
- (Optional) A list of IP rules in CIDR format. Defaults to[]
.virtual_network_subnet_ids
- (Optional) When using with Service Endpoints, a list of subnet IDs to associate with the Key Vault. Defaults to[]
.
Type:
object({
bypass = optional(string, "None")
default_action = optional(string, "Deny")
ip_rules = optional(list(string), [])
virtual_network_subnet_ids = optional(list(string), [])
})
Default: {}
Description: A map of private endpoints to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
name
- (Optional) The name of the private endpoint. One will be generated if not set.role_assignments
- (Optional) A map of role assignments to create on the private endpoint. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time. Seevar.role_assignments
for more information.lock
- (Optional) The lock level to apply to the private endpoint. Default isNone
. Possible values areNone
,CanNotDelete
, andReadOnly
.tags
- (Optional) A mapping of tags to assign to the private endpoint.subnet_resource_id
- The resource ID of the subnet to deploy the private endpoint in.private_dns_zone_group_name
- (Optional) The name of the private DNS zone group. One will be generated if not set.private_dns_zone_resource_ids
- (Optional) A set of resource IDs of private DNS zones to associate with the private endpoint. If not set, no zone groups will be created and the private endpoint will not be associated with any private DNS zones. DNS records must be managed external to this module.application_security_group_resource_ids
- (Optional) A map of resource IDs of application security groups to associate with the private endpoint. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.private_service_connection_name
- (Optional) The name of the private service connection. One will be generated if not set.network_interface_name
- (Optional) The name of the network interface. One will be generated if not set.location
- (Optional) The Azure location where the resources will be deployed. Defaults to the location of the resource group.resource_group_name
- (Optional) The resource group where the resources will be deployed. Defaults to the resource group of the Key Vault.ip_configurations
- (Optional) A map of IP configurations to create on the private endpoint. If not specified the platform will create one. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.name
- The name of the IP configuration.private_ip_address
- The private IP address of the IP configuration.
Type:
map(object({
name = optional(string, null)
role_assignments = optional(map(object({
role_definition_id_or_name = string
principal_id = string
description = optional(string, null)
skip_service_principal_aad_check = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
delegated_managed_identity_resource_id = optional(string, null)
})), {})
lock = optional(object({
name = optional(string, null)
kind = optional(string, "None")
}), {})
tags = optional(map(any), null)
subnet_resource_id = string
private_dns_zone_group_name = optional(string, "default")
private_dns_zone_resource_ids = optional(set(string), [])
application_security_group_associations = optional(map(string), {})
private_service_connection_name = optional(string, null)
network_interface_name = optional(string, null)
location = optional(string, null)
resource_group_name = optional(string, null)
ip_configurations = optional(map(object({
name = string
private_ip_address = string
})), {})
}))
Default: {}
Description: Specifies whether public access is permitted.
Type: bool
Default: true
Description: Specifies whether protection against purge is enabled for this Key Vault. Note once enabled this cannot be disabled.
Type: bool
Default: true
Description: A map of role assignments to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
role_definition_id_or_name
- The ID or name of the role definition to assign to the principal.principal_id
- The ID of the principal to assign the role to.description
- The description of the role assignment.skip_service_principal_aad_check
- If set to true, skips the Azure Active Directory check for the service principal in the tenant. Defaults to false.condition
- The condition which will be used to scope the role assignment.condition_version
- The version of the condition syntax. If you are using a condition, valid values are '2.0'.
Note: only set
skip_service_principal_aad_check
to true if you are assigning a role to a service principal.
Type:
map(object({
role_definition_id_or_name = string
principal_id = string
description = optional(string, null)
skip_service_principal_aad_check = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
delegated_managed_identity_resource_id = optional(string, null)
}))
Default: {}
Description: A map of secrets to create on the Key Vault. The map key is deliberately arbitrary to avoid issues where map keys maybe unknown at plan time.
name
- The name of the secret.content_type
- The content type of the secret.tags
- A mapping of tags to assign to the secret.not_before_date
- The not before date of the secret.expiration_date
- The expiration date of the secret.
Supply role assignments in the same way as for var.role_assignments
.
Note: the
value
of the secret is supplied via thevar.secrets_value
variable. Make sure to use the same map key.
Type:
map(object({
name = string
content_type = optional(string, null)
tags = optional(map(any), null)
not_before_date = optional(string, null)
expiration_date = optional(string, null)
role_assignments = optional(map(object({
role_definition_id_or_name = string
principal_id = string
description = optional(string, null)
skip_service_principal_aad_check = optional(bool, false)
condition = optional(string, null)
condition_version = optional(string, null)
delegated_managed_identity_resource_id = optional(string, null)
})), {})
}))
Default: {}
Description: A map of secret keys to values.
The map key is the supplied input to var.secrets
.
The map value is the secret value.
This is a separate variable to var.secrets
because it is sensitive and therefore cannot be used in a for_each
loop.
Type: map(string)
Default: {}
Description: The SKU name of the Key Vault. Default is premium
. Possible values are
standardand
premium.
Type: string
Default: "premium"
Description: The number of days that items should be retained for once soft-deleted. This value can be between 7 and 90 (the default) days.
Type: number
Default: null
Description: Map of tags to assign to the Key Vault resource.
Type: map(any)
Default: null
Description: The Azure tenant ID used for authenticating requests to Key Vault.
By default this value is null, in which case the current tenant is used.
Type: string
Default: null
Description: This variable controls the amount of time to wait before performing key operations.
It only applies when var.role_assignments
and var.keys
are both set.
This is useful when you are creating role assignments on the key vault and immediately creating keys in it.
The default is 30 seconds for create and 0 seconds for destroy.
Type:
object({
create = optional(string, "30s")
destroy = optional(string, "0s")
})
Default: {}
Description: This variable controls the amount of time to wait before performing secret operations.
It only applies when var.role_assignments
and var.secrets
are both set.
This is useful when you are creating role assignments on the key vault and immediately creating secrets in it.
The default is 30 seconds for create and 0 seconds for destroy.
Type:
object({
create = optional(string, "30s")
destroy = optional(string, "0s")
})
Default: {}
The following outputs are exported:
Description: A map of private endpoints. The map key is the supplied input to var.private_endpoints. The map value is the entire azurerm_private_endpoint resource.
Description: The Key Vault resource.
Description: A map of key objects. The map key is the supplied input to var.keys. The map value is the entire azurerm_key_vault_key resource.
Description: A map of secret objects. The map key is the supplied input to var.secrets. The map value is the entire azurerm_key_vault_secret resource.
No modules.
The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.