Skip to content

Commit a45ade1

Browse files
githubofkrishnadhasgithubofkrishnadhas
authored
Add Azure Key Vault with Private Endpoint Integration (#23)
* DEVOPS-312 kv with private endpoint inside access * adding depends on conditions
1 parent 19aef4b commit a45ade1

File tree

6 files changed

+369
-0
lines changed

6 files changed

+369
-0
lines changed

‎keyvault-with-private-endpoint/README.md‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
<!-- BEGIN_AUTOMATED_TF_DOCS_BLOCK -->
2+
## Requirements
3+
4+
| Name | Version |
5+
|------|---------|
6+
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.3 |
7+
| <a name="requirement_azurerm"></a> [azurerm](#requirement_azurerm) | <= 4.0 |
8+
| <a name="requirement_random"></a> [random](#requirement_random) | >= 3.1 |
9+
## Usage
10+
Basic usage of this module is as follows:
11+
```hcl
12+
module "example" {
13+
source = "<module-path>"
14+
15+
# Required variables
16+
keyvault_name =
17+
resource_group_name =
18+
19+
# Optional variables
20+
application_name = "devwithkrishna"
21+
azure_disk_encryption_can_retrieve_secrets = false
22+
azure_resource_manager_can_retrieve_secrets = false
23+
azure_vms_can_access_certs_stored_as_secrets = false
24+
enable_rbac_authorization = false
25+
environment = "DEV"
26+
location = ""
27+
public_network_access_enabled = true
28+
purge_protection_enabled = false
29+
sku_name = "standard"
30+
soft_delete_retention_days = 90
31+
temporary = "TRUE"
32+
}
33+
```
34+
35+
## Resources
36+
37+
| Name | Type |
38+
|------|------|
39+
| [azurerm_key_vault.kv](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) | resource |
40+
| [azurerm_resource_group.keyvault_rg](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/resource_group) | resource |
41+
| [azurerm_client_config.current](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |
42+
43+
## Inputs
44+
45+
| Name | Description | Type | Required |
46+
|------|-------------|------|:--------:|
47+
| <a name="input_application_name"></a> [application_name](#input_application_name) | Azure application name tag | `string` | no |
48+
| <a name="input_azure_disk_encryption_can_retrieve_secrets"></a> [azure_disk_encryption_can_retrieve_secrets](#input_azure_disk_encryption_can_retrieve_secrets) | Boolean flag to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys | `bool` | no |
49+
| <a name="input_azure_resource_manager_can_retrieve_secrets"></a> [azure_resource_manager_can_retrieve_secrets](#input_azure_resource_manager_can_retrieve_secrets) | Boolean flag to specify whether Azure Resource Manager is permitted to retrieve secrets from the vault | `bool` | no |
50+
| <a name="input_azure_vms_can_access_certs_stored_as_secrets"></a> [azure_vms_can_access_certs_stored_as_secrets](#input_azure_vms_can_access_certs_stored_as_secrets) | Boolean flag to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault | `bool` | no |
51+
| <a name="input_enable_rbac_authorization"></a> [enable_rbac_authorization](#input_enable_rbac_authorization) | Boolean flag to specify whether Azure Key Vault uses Role Based Access Control (RBAC) for authorization of data actions | `bool` | no |
52+
| <a name="input_environment"></a> [environment](#input_environment) | Environment tag value in Azure | `string` | no |
53+
| <a name="input_keyvault_name"></a> [keyvault_name](#input_keyvault_name) | Azure keyvault name | `string` | yes |
54+
| <a name="input_location"></a> [location](#input_location) | Azure keyvault location | `string` | no |
55+
| <a name="input_public_network_access_enabled"></a> [public_network_access_enabled](#input_public_network_access_enabled) | Whether public network access is allowed for this Key Vault | `bool` | no |
56+
| <a name="input_purge_protection_enabled"></a> [purge_protection_enabled](#input_purge_protection_enabled) | Purge Protection enabled or not | `bool` | no |
57+
| <a name="input_resource_group_name"></a> [resource_group_name](#input_resource_group_name) | Azure keyvault Rg | `string` | yes |
58+
| <a name="input_sku_name"></a> [sku_name](#input_sku_name) | Keyvault SKUs available in azure. Valid options are standard and premium | `string` | no |
59+
| <a name="input_soft_delete_retention_days"></a> [soft_delete_retention_days](#input_soft_delete_retention_days) | The number of days that items should be retained for once soft-deleted. This value can be between 7 and 90 | `number` | no |
60+
| <a name="input_temporary"></a> [temporary](#input_temporary) | Temporary tag value in Azure | `string` | no |
61+
62+
## Outputs
63+
64+
| Name | Description |
65+
|------|-------------|
66+
| <a name="output_azurerm_resource_group"></a> [azurerm_resource_group](#output_azurerm_resource_group) | Azure resource group name |
67+
| <a name="output_enable_rbac_authorization"></a> [enable_rbac_authorization](#output_enable_rbac_authorization) | Azure kv RBAC access enabled or not |
68+
| <a name="output_enabled_for_deployment"></a> [enabled_for_deployment](#output_enabled_for_deployment) | Azure vms can access certs from kv |
69+
| <a name="output_enabled_for_disk_encryption"></a> [enabled_for_disk_encryption](#output_enabled_for_disk_encryption) | Azure disk encryption can access keys from keyvault or not |
70+
| <a name="output_enabled_for_template_deployment"></a> [enabled_for_template_deployment](#output_enabled_for_template_deployment) | Azure resource manager can access secrets or not |
71+
| <a name="output_keyvault_location"></a> [keyvault_location](#output_keyvault_location) | Azure keyvault location |
72+
| <a name="output_keyvault_name"></a> [keyvault_name](#output_keyvault_name) | Azure keyvault name |
73+
| <a name="output_keyvault_sku"></a> [keyvault_sku](#output_keyvault_sku) | Azure Keyvault SKu |
74+
| <a name="output_public_access_enabled"></a> [public_access_enabled](#output_public_access_enabled) | Azure kv enabled public access or not |
75+
<!-- END_AUTOMATED_TF_DOCS_BLOCK -->

‎keyvault-with-private-endpoint/data.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
data "azurerm_client_config" "current" {}
2+
3+
data "azurerm_subnet" "pvt_end_pt" {
4+
name = var.subnet_name
5+
virtual_network_name = var.virtual_network_name
6+
resource_group_name = var.virtual_network_rg
7+
}
8+
9+
data "azurerm_private_dns_zone" "key_vault_dns_zone" {
10+
name = "privatelink.vaultcore.azure.net"
11+
resource_group_name = "ARCHITECTS-CENTRAL-INDIA-AKS-VNET-RG"
12+
}

‎keyvault-with-private-endpoint/keyvault.tf‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
resource "azurerm_resource_group" "keyvault_rg" {
2+
name = var.resource_group_name
3+
location = var.location
4+
tags = {
5+
Environment = upper(var.environment)
6+
Orchestrator = "Terraform"
7+
DisplayName = upper(var.resource_group_name)
8+
ApplicationName = lower(var.application_name)
9+
Temporary = upper(var.temporary)
10+
}
11+
}
12+
13+
resource "azurerm_key_vault" "kv" {
14+
name = var.keyvault_name
15+
resource_group_name = azurerm_resource_group.keyvault_rg.name
16+
location = azurerm_resource_group.keyvault_rg.location
17+
tenant_id = data.azurerm_client_config.current.tenant_id
18+
sku_name = var.sku_name
19+
20+
enable_rbac_authorization = var.enable_rbac_authorization
21+
enabled_for_deployment = var.azure_vms_can_access_certs_stored_as_secrets
22+
enabled_for_disk_encryption = var.azure_disk_encryption_can_retrieve_secrets
23+
enabled_for_template_deployment = var.azure_resource_manager_can_retrieve_secrets
24+
25+
purge_protection_enabled = var.purge_protection_enabled
26+
soft_delete_retention_days = var.soft_delete_retention_days
27+
28+
public_network_access_enabled = var.public_network_access_enabled
29+
30+
depends_on = [ azurerm_resource_group.keyvault_rg ]
31+
network_acls {
32+
bypass = "AzureServices" # Specifies which traffic can bypass the network rules
33+
default_action = "Deny" # Specifies the default action when no rule from ip_rules and virtual_network_subnet_ids match
34+
virtual_network_subnet_ids = [data.azurerm_subnet.pvt_end_pt.id] # List of subnet ids that can access the key vault
35+
}
36+
37+
access_policy {
38+
tenant_id = data.azurerm_client_config.current.tenant_id
39+
object_id = data.azurerm_client_config.current.object_id
40+
41+
key_permissions = [
42+
"Get", "List", "Create", "Recover", "Purge", "UnwrapKey", "Update", "WrapKey", "Rotate", "GetRotationPolicy", "SetRotationPolicy"
43+
]
44+
45+
secret_permissions = [
46+
"Get", "Set", "List", "Delete", "Recover"
47+
]
48+
49+
storage_permissions = [
50+
"Get", "Delete", "List", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update"
51+
]
52+
53+
certificate_permissions = [
54+
"Create", "Delete", "Get", "GetIssuers", "Import", "List", "ListIssuers", "ManageIssuers", "SetIssuers", "Update"
55+
]
56+
57+
}
58+
59+
tags = {
60+
Environment = upper(var.environment)
61+
Orchestrator = "Terraform"
62+
DisplayName = upper(var.keyvault_name)
63+
ApplicationName = lower(var.application_name)
64+
Temporary = upper(var.temporary)
65+
66+
}
67+
}
68+
69+
70+
resource "azurerm_private_endpoint" "pvt_end_pt" {
71+
name = "${var.keyvault_name}-pvt-end-pt"
72+
location = azurerm_resource_group.keyvault_rg.location
73+
resource_group_name = azurerm_resource_group.keyvault_rg.name
74+
subnet_id = data.azurerm_subnet.pvt_end_pt.id
75+
custom_network_interface_name = "${var.keyvault_name}-pvt-end-pt-nic"
76+
77+
depends_on = [ azurerm_key_vault.kv, azurerm_resource_group.keyvault_rg ]
78+
79+
private_service_connection {
80+
name = lower("${azurerm_key_vault.kv.name}-psc")
81+
private_connection_resource_id = azurerm_key_vault.kv.id
82+
is_manual_connection = false
83+
subresource_names = ["Vault"]
84+
}
85+
86+
private_dns_zone_group {
87+
name = "privatelink.vaultcore.azure.net"
88+
private_dns_zone_ids = [data.azurerm_private_dns_zone.key_vault_dns_zone.id]
89+
}
90+
91+
}
92+
93+
94+
resource "azurerm_private_dns_a_record" "pvt_dns_a_record" {
95+
name = var.keyvault_name
96+
zone_name = data.azurerm_private_dns_zone.key_vault_dns_zone.name
97+
resource_group_name = data.azurerm_private_dns_zone.key_vault_dns_zone.resource_group_name
98+
ttl = 300
99+
records = [azurerm_private_endpoint.pvt_end_pt.private_service_connection.0.private_ip_address]
100+
depends_on = [ azurerm_private_endpoint.pvt_end_pt ]
101+
}

‎keyvault-with-private-endpoint/output.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
output "azurerm_resource_group" {
2+
description = "Azure resource group name"
3+
value = azurerm_resource_group.keyvault_rg
4+
}
5+
6+
output "keyvault_name" {
7+
description = "Azure keyvault name"
8+
value = azurerm_key_vault.kv.name
9+
}
10+
11+
output "keyvault_location" {
12+
description = "Azure keyvault location"
13+
value = azurerm_key_vault.kv.location
14+
}
15+
16+
output "keyvault_sku" {
17+
description = "Azure Keyvault SKu"
18+
value = azurerm_key_vault.kv.sku_name
19+
}
20+
21+
output "enable_rbac_authorization" {
22+
description = "Azure kv RBAC access enabled or not"
23+
value = azurerm_key_vault.kv.enable_rbac_authorization
24+
}
25+
26+
output "enabled_for_deployment" {
27+
description = "Azure vms can access certs from kv"
28+
value = azurerm_key_vault.kv.enabled_for_deployment
29+
}
30+
31+
output "enabled_for_disk_encryption" {
32+
description = "Azure disk encryption can access keys from keyvault or not"
33+
value = azurerm_key_vault.kv.enabled_for_disk_encryption
34+
}
35+
36+
output "enabled_for_template_deployment" {
37+
description = "Azure resource manager can access secrets or not"
38+
value = azurerm_key_vault.kv.enabled_for_template_deployment
39+
}
40+
output "public_access_enabled" {
41+
description = "Azure kv enabled public access or not"
42+
value = azurerm_key_vault.kv.public_network_access_enabled
43+
}
44+
45+
output "privat_enedpoint_ipaddress" {
46+
description = "Azure kv private endpoint address"
47+
value = azurerm_private_endpoint.pvt_end_pt.private_service_connection.0.private_ip_address
48+
}

‎keyvault-with-private-endpoint/providers.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
terraform {
2+
required_version = "~> 1.3"
3+
required_providers {
4+
azurerm = {
5+
source = "hashicorp/azurerm"
6+
version = "<= 4.0"
7+
}
8+
random = {
9+
source = "hashicorp/random"
10+
version = ">= 3.1"
11+
}
12+
}
13+
}
14+
provider "azurerm" {
15+
features {}
16+
}

‎keyvault-with-private-endpoint/variables.tf‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
variable "resource_group_name" {
2+
type = string
3+
description = "Azure keyvault Rg"
4+
}
5+
6+
variable "location" {
7+
type = string
8+
description = "Azure keyvault location"
9+
default = ""
10+
}
11+
12+
variable "keyvault_name" {
13+
description = "Azure keyvault name"
14+
type = string
15+
16+
}
17+
18+
variable "sku_name" {
19+
default = "standard"
20+
description = "Keyvault SKUs available in azure. Valid options are standard and premium"
21+
validation {
22+
condition = contains(["standard", "premium"], var.sku_name)
23+
error_message = "Keyvault SKU should be one among standard or premium"
24+
}
25+
}
26+
27+
variable "environment" {
28+
default = "DEV"
29+
description = "Environment tag value in Azure"
30+
type = string
31+
validation {
32+
condition = contains(["DEV", "QA", "UAT", "PROD"], var.environment)
33+
error_message = "Environment value should be one among DEV or QA or UAT or PROD."
34+
}
35+
}
36+
37+
variable "application_name" {
38+
default = "devwithkrishna"
39+
description = "Azure application name tag"
40+
}
41+
42+
43+
variable "temporary" {
44+
default = "TRUE"
45+
description = "Temporary tag value in Azure"
46+
type = string
47+
validation {
48+
condition = contains(["TRUE", "FALSE"], upper(var.temporary))
49+
error_message = "The temporary tag value must be either 'TRUE' or 'FALSE'."
50+
}
51+
52+
}
53+
54+
variable "azure_vms_can_access_certs_stored_as_secrets" {
55+
default = false
56+
type = bool
57+
description = "Boolean flag to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault"
58+
}
59+
60+
variable "azure_disk_encryption_can_retrieve_secrets" {
61+
default = false
62+
type = bool
63+
description = "Boolean flag to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys"
64+
}
65+
66+
variable "azure_resource_manager_can_retrieve_secrets" {
67+
default = false
68+
type = bool
69+
description = "Boolean flag to specify whether Azure Resource Manager is permitted to retrieve secrets from the vault"
70+
}
71+
72+
variable "enable_rbac_authorization" {
73+
default = false
74+
type = bool
75+
description = "Boolean flag to specify whether Azure Key Vault uses Role Based Access Control (RBAC) for authorization of data actions"
76+
}
77+
78+
variable "purge_protection_enabled" {
79+
type = bool
80+
default = false
81+
description = "Purge Protection enabled or not"
82+
}
83+
84+
variable "public_network_access_enabled" {
85+
default = true
86+
type = bool
87+
description = "Whether public network access is allowed for this Key Vault"
88+
}
89+
90+
variable "soft_delete_retention_days" {
91+
default = 90
92+
type = number
93+
description = " The number of days that items should be retained for once soft-deleted. This value can be between 7 and 90"
94+
validation {
95+
condition = var.soft_delete_retention_days >= 7 && var.soft_delete_retention_days <= 90
96+
error_message = "This value should be between 7 and 90 both included."
97+
}
98+
}
99+
100+
101+
variable "virtual_network_name" {
102+
type = string
103+
description = "Name of the virtual network in which private endpoint will be created"
104+
default = ""
105+
}
106+
107+
variable "subnet_name" {
108+
type = string
109+
description = "Name of the subnet in which private endpoint will be created"
110+
default = ""
111+
}
112+
113+
variable "virtual_network_rg" {
114+
type = string
115+
default = "value"
116+
description = "Virtual network resource group"
117+
}

0 commit comments

Comments
 (0)