Skip to content

Commit 9ca5386

Browse files
brown9804brown9804
committed
keyvault sample
1 parent c7c334a commit 9ca5386

7 files changed

Lines changed: 345 additions & 0 deletions

File tree

‎4_identity-security/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ Last updated: 2026-02-03
1515
## Templates available
1616

1717
- [Microsoft Entra ID (Entra ID)](./entra_id)
18+
- [Azure Key Vault](./key-vault)
1819

1920
<!-- START BADGE -->
2021
<div align="center">

‎4_identity-security/key-vault/README.md‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
````markdown
2+
# Terraform Template - Azure Key Vault
3+
4+
Costa Rica
5+
6+
[![GitHub](https://img.shields.io/badge/--181717?logo=github&logoColor=ffffff)](https://github.com/)
7+
[brown9804](https://github.com/brown9804)
8+
9+
Last updated: 2026-02-06
10+
11+
------------------------------------------
12+
13+
> This template contains Terraform configurations to create and manage an Azure Key Vault with dependencies on a Resource Group.
14+
15+
> [!NOTE]
16+
> Key Vault data-plane access (secrets/keys/certificates) depends on your authorization mode:
17+
> - If `enable_rbac_authorization = true`, grant Azure RBAC roles (for example: Key Vault Secrets Officer) at the vault scope.
18+
> - If `enable_rbac_authorization = false`, you must manage Key Vault access policies (not included in this minimal template).
19+
20+
## File Descriptions
21+
22+
- **main.tf**: Contains the main configuration for creating the Azure Key Vault and the Resource Group it depends on.
23+
- **variables.tf**: Defines the input variables used in the Terraform configuration.
24+
- **provider.tf**: Configures the Azure provider to interact with Azure resources.
25+
- **terraform.tfvars**: Provides example values for the variables defined in `variables.tf`.
26+
- **outputs.tf**: Defines the outputs of the Terraform configuration, such as the Key Vault URI and Resource Group.
27+
28+
## Variables
29+
30+
Below is a list of variables used in this template, their expected values, types, and examples:
31+
32+
| Variable Name | Description | Type | Example Value |
33+
| --- | --- | --- | --- |
34+
| `resource_group_name` | The name of the Azure Resource Group to associate the Key Vault with. | string | `"rg-identity-security-dev"` |
35+
| `location` | The Azure region where the Resource Group will be created. | string | `"East US"` |
36+
| `key_vault_name` | The name of the Azure Key Vault to create. | string | `"kvidentitydev001"` |
37+
| `key_vault_name_use_random_suffix` | Append a short random suffix to avoid global name collisions. | bool | `true` |
38+
| `sku_name` | The SKU name for Key Vault (`standard` or `premium`). | string | `"standard"` |
39+
| `enable_rbac_authorization` | Use Azure RBAC for data-plane permissions. | bool | `true` |
40+
| `public_network_access_enabled` | Enable or disable public network access. | bool | `true` |
41+
| `soft_delete_retention_days` | Soft delete retention days (7-90). | number | `90` |
42+
| `purge_protection_enabled` | Enable purge protection (affects destroy). | bool | `false` |
43+
| `network_default_action` | Network ACL default action (`Allow` or `Deny`). | string | `"Allow"` |
44+
| `network_bypass` | Firewall bypass (`AzureServices` or `None`). | string | `"AzureServices"` |
45+
| `ip_rules` | List of public IPs/CIDRs allowed. | list(string) | `[]` |
46+
| `virtual_network_subnet_ids` | List of subnet IDs allowed. | list(string) | `[]` |
47+
| `tags` | A map of tags to assign to the resources. | map(string) | `{ "env": "dev" }` |
48+
49+
## Usage
50+
51+
1. Authenticate:
52+
53+
```sh
54+
az login
55+
```
56+
57+
2. Ensure Azure CLI has the correct active subscription:
58+
59+
```sh
60+
az account show
61+
# If needed:
62+
az account set --subscription "<subscription-id-or-name>"
63+
```
64+
65+
3. Initialize:
66+
67+
```sh
68+
terraform init -upgrade
69+
```
70+
71+
4. Validate and plan:
72+
73+
```sh
74+
terraform validate
75+
terraform plan
76+
```
77+
78+
5. Apply:
79+
80+
```sh
81+
terraform apply -auto-approve
82+
```
83+
84+
## Notes
85+
86+
- This template creates the Resource Group for you.
87+
- Key Vault names are globally unique. If you see `VaultAlreadyExists`, either change the base name or keep `key_vault_name_use_random_suffix = true`.
88+
- If you enable `purge_protection_enabled`, Key Vault deletion becomes more restrictive and `terraform destroy` may fail until purge protection rules allow cleanup.
89+
90+
<!-- START BADGE -->
91+
<div align="center">
92+
<img src="https://img.shields.io/badge/Total%20views-0-limegreen" alt="Total views">
93+
<p>Refresh Date: 2026-02-06</p>
94+
</div>
95+
<!-- END BADGE -->
96+
97+
````

‎4_identity-security/key-vault/main.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# main.tf
2+
# This file contains the main configuration for creating Azure Key Vault.
3+
# It defines the resource blocks for the Azure Resource Group and Key Vault.
4+
5+
data "azurerm_client_config" "current" {}
6+
7+
resource "random_id" "kv_suffix" {
8+
byte_length = 2
9+
}
10+
11+
locals {
12+
effective_tenant_id = data.azurerm_client_config.current.tenant_id
13+
effective_key_vault_name = lower(
14+
var.key_vault_name_use_random_suffix
15+
? "${var.key_vault_name}${random_id.kv_suffix.hex}"
16+
: var.key_vault_name
17+
)
18+
}
19+
20+
resource "azurerm_resource_group" "example" {
21+
name = var.resource_group_name
22+
location = var.location
23+
24+
tags = var.tags
25+
}
26+
27+
resource "azurerm_key_vault" "example" {
28+
name = local.effective_key_vault_name
29+
location = azurerm_resource_group.example.location
30+
resource_group_name = azurerm_resource_group.example.name
31+
tenant_id = local.effective_tenant_id
32+
sku_name = lower(var.sku_name)
33+
enable_rbac_authorization = var.enable_rbac_authorization
34+
public_network_access_enabled = var.public_network_access_enabled
35+
36+
soft_delete_retention_days = var.soft_delete_retention_days
37+
purge_protection_enabled = var.purge_protection_enabled
38+
39+
network_acls {
40+
default_action = var.network_default_action
41+
bypass = var.network_bypass
42+
ip_rules = var.ip_rules
43+
virtual_network_subnet_ids = var.virtual_network_subnet_ids
44+
}
45+
46+
tags = var.tags
47+
48+
depends_on = [
49+
azurerm_resource_group.example
50+
]
51+
}

‎4_identity-security/key-vault/outputs.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# outputs.tf
2+
# This file defines the outputs of the Terraform configuration.
3+
4+
output "key_vault_id" {
5+
description = "The resource ID of the Key Vault."
6+
value = azurerm_key_vault.example.id
7+
}
8+
9+
output "key_vault_name" {
10+
description = "The name of the Key Vault."
11+
value = azurerm_key_vault.example.name
12+
}
13+
14+
output "key_vault_uri" {
15+
description = "The DNS name (vault URI) of the Key Vault."
16+
value = azurerm_key_vault.example.vault_uri
17+
}
18+
19+
output "resource_group_name" {
20+
description = "The name of the Resource Group created for this template."
21+
value = azurerm_resource_group.example.name
22+
}
23+
24+
output "tenant_id" {
25+
description = "The tenant ID used for the Key Vault."
26+
value = local.effective_tenant_id
27+
}

‎4_identity-security/key-vault/provider.tf‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# provider.tf
2+
# This file configures the Azure provider to interact with Azure resources.
3+
# It specifies the required provider and its version, along with provider-specific configurations.
4+
5+
terraform {
6+
required_version = ">= 1.8, < 2.0"
7+
8+
required_providers {
9+
azurerm = {
10+
source = "hashicorp/azurerm" # Source of the AzureRM provider
11+
version = "~> 3.116" # Version of the AzureRM provider
12+
}
13+
14+
random = {
15+
source = "hashicorp/random"
16+
version = "~> 3.5"
17+
}
18+
}
19+
}
20+
21+
provider "azurerm" {
22+
features {
23+
resource_group {
24+
prevent_deletion_if_contains_resources = false
25+
}
26+
}
27+
28+
# Uses the current Azure CLI context (az login + az account set)
29+
skip_provider_registration = false
30+
}
31+
32+
provider "random" {}

‎4_identity-security/key-vault/terraform.tfvars‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# Example values for the Key Vault template
2+
3+
resource_group_name = "rg-identity-security-dev"
4+
location = "East US"
5+
key_vault_name = "kvidentitydev001"
6+
7+
# Key Vault names are globally unique; keep this true to avoid collisions.
8+
key_vault_name_use_random_suffix = true
9+
10+
11+
12+
# Optional
13+
sku_name = "standard"
14+
enable_rbac_authorization = true
15+
public_network_access_enabled = true
16+
soft_delete_retention_days = 90
17+
purge_protection_enabled = false
18+
19+
tags = {
20+
env = "dev"
21+
app = "identity-security"
22+
owner = "terraform"
23+
}
24+
25+
# Network ACLs (optional)
26+
network_default_action = "Allow"
27+
network_bypass = "AzureServices"
28+
ip_rules = []
29+
virtual_network_subnet_ids = []

‎4_identity-security/key-vault/variables.tf‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# variables.tf
2+
# This file defines the input variables used in the Terraform configuration.
3+
4+
variable "resource_group_name" {
5+
description = "The name of the Azure Resource Group to associate the Key Vault with."
6+
type = string
7+
}
8+
9+
variable "location" {
10+
description = "The Azure region where the Resource Group will be created."
11+
type = string
12+
}
13+
14+
variable "key_vault_name" {
15+
description = "The base name of the Azure Key Vault to create (3-24 characters, alphanumeric only)."
16+
type = string
17+
18+
validation {
19+
condition = can(regex("^[0-9A-Za-z]{3,24}$", var.key_vault_name))
20+
error_message = "key_vault_name must be 3-24 characters and alphanumeric only (A-Z, a-z, 0-9)."
21+
}
22+
}
23+
24+
variable "key_vault_name_use_random_suffix" {
25+
description = "When true, appends a short random suffix to the Key Vault name to avoid global name collisions."
26+
type = bool
27+
default = true
28+
}
29+
30+
variable "sku_name" {
31+
description = "The SKU name for Key Vault. Valid values: standard, premium."
32+
type = string
33+
default = "standard"
34+
35+
validation {
36+
condition = contains(["standard", "premium"], lower(var.sku_name))
37+
error_message = "sku_name must be either 'standard' or 'premium'."
38+
}
39+
}
40+
41+
variable "enable_rbac_authorization" {
42+
description = "When true, Key Vault data-plane access is controlled via Azure RBAC instead of access policies."
43+
type = bool
44+
default = true
45+
}
46+
47+
variable "public_network_access_enabled" {
48+
description = "When true, allows public network access to the Key Vault (subject to firewall rules)."
49+
type = bool
50+
default = true
51+
}
52+
53+
variable "soft_delete_retention_days" {
54+
description = "Number of days to retain soft-deleted vaults, keys, secrets, and certificates."
55+
type = number
56+
default = 90
57+
58+
validation {
59+
condition = var.soft_delete_retention_days >= 7 && var.soft_delete_retention_days <= 90
60+
error_message = "soft_delete_retention_days must be between 7 and 90."
61+
}
62+
}
63+
64+
variable "purge_protection_enabled" {
65+
description = "Enable purge protection (recommended for production; can affect destroy workflows)."
66+
type = bool
67+
default = false
68+
}
69+
70+
variable "tags" {
71+
description = "A map of tags to assign to the resources."
72+
type = map(string)
73+
default = {}
74+
}
75+
76+
variable "network_default_action" {
77+
description = "Default action for Key Vault network ACLs. Valid values: Allow, Deny."
78+
type = string
79+
default = "Allow"
80+
81+
validation {
82+
condition = contains(["Allow", "Deny"], var.network_default_action)
83+
error_message = "network_default_action must be either 'Allow' or 'Deny'."
84+
}
85+
}
86+
87+
variable "network_bypass" {
88+
description = "Specifies which traffic can bypass the firewall. Valid values: AzureServices, None."
89+
type = string
90+
default = "AzureServices"
91+
92+
validation {
93+
condition = contains(["AzureServices", "None"], var.network_bypass)
94+
error_message = "network_bypass must be either 'AzureServices' or 'None'."
95+
}
96+
}
97+
98+
variable "ip_rules" {
99+
description = "List of public IPs/CIDRs permitted to access the Key Vault when network ACLs are enabled."
100+
type = list(string)
101+
default = []
102+
}
103+
104+
variable "virtual_network_subnet_ids" {
105+
description = "List of subnet resource IDs permitted to access the Key Vault when network ACLs are enabled."
106+
type = list(string)
107+
default = []
108+
}

0 commit comments

Comments
 (0)