Skip to content

Commit 6681a97

Browse files
kumarvnakumarvna
authored
Merge pull request #8 from kumarvna/develop
adding SPN access policies and private endpoint
2 parents 8dabf52 + 5d8667d commit 6681a97

File tree

21 files changed

+1157
-269
lines changed

21 files changed

+1157
-269
lines changed

‎README.md‎

Lines changed: 143 additions & 53 deletions
Large diffs are not rendered by default.

‎examples/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Azure Key Vault Terraform Module
2+
3+
Terraform Module to create a Key Vault also adds required access policies for azure AD users, groups and azure AD service principals. This module also creates private endpoint and sends all logs to log analytic workspace or storage.
4+
5+
## Module Usage for
6+
7+
* [Simple Key Vault Creation](simple_keyvault/)
8+
* [Key Vault with Private Endpoint](keyvault_with_private_end_point/)
9+
* [Key Vault and Private Endpoiont using existing VNet and Subnet](keyvault_private_end_point_with_existing_VNet_Subnet/)
10+
11+
## Terraform Usage
12+
13+
To run this example you need to execute following Terraform commands
14+
15+
```hcl
16+
terraform init
17+
terraform plan
18+
terraform apply
19+
```
20+
21+
Run `terraform destroy` when you don't need these resources.

‎examples/complete/main.tf‎

Lines changed: 0 additions & 57 deletions
This file was deleted.

‎examples/complete/output.tf‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎examples/keyvault_private_end_point_with_existing_VNet_Subnet/README.md‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# Azure Key Vault Terraform Module
2+
3+
Terraform Module to create a Key Vault also adds required access policies for azure AD users, groups and azure AD service principals. This module also creates private endpoint and sends all logs to log analytic workspace or storage.
4+
5+
## Module Usage to enable privaite endpoint using existing VNet and Subnet
6+
7+
```hcl
8+
# Azurerm Provider configuration
9+
provider "azurerm" {
10+
features {}
11+
}
12+
13+
data "azurerm_virtual_network" "example" {
14+
name = "vnet-shared-hub-westeurope-001"
15+
resource_group_name = "rg-shared-westeurope-01"
16+
}
17+
18+
data "azurerm_subnet" "example" {
19+
name = "snet-private-ep"
20+
virtual_network_name = data.azurerm_virtual_network.example.name
21+
resource_group_name = data.azurerm_virtual_network.example.resource_group_name
22+
}
23+
24+
module "key-vault" {
25+
source = "kumarvna/key-vault/azurerm"
26+
version = "2.2.0"
27+
28+
# By default, this module will not create a resource group and expect to provide
29+
# a existing RG name to use an existing resource group. Location will be same as existing RG.
30+
# set the argument to `create_resource_group = true` to create new resrouce.
31+
resource_group_name = "rg-shared-westeurope-01"
32+
key_vault_name = "demo-project-shard"
33+
key_vault_sku_pricing_tier = "premium"
34+
35+
# Once `Purge Protection` has been Enabled it's not possible to Disable it
36+
# Deleting the Key Vault with `Purge Protection` enabled will schedule the Key Vault to be deleted
37+
# The default retention period is 90 days, possible values are from 7 to 90 days
38+
# use `soft_delete_retention_days` to set the retention period
39+
enable_purge_protection = false
40+
# soft_delete_retention_days = 90
41+
42+
# Access policies for users, you can provide list of Azure AD users and set permissions.
43+
# Make sure to use list of user principal names of Azure AD users.
44+
access_policies = [
45+
{
46+
azure_ad_user_principal_names = ["[email protected]", "[email protected]"]
47+
key_permissions = ["get", "list"]
48+
secret_permissions = ["get", "list"]
49+
certificate_permissions = ["get", "import", "list"]
50+
storage_permissions = ["backup", "get", "list", "recover"]
51+
},
52+
53+
# Access policies for AD Groups
54+
# to enable this feature, provide a list of Azure AD groups and set permissions as required.
55+
{
56+
azure_ad_group_names = ["ADGroupName1", "ADGroupName2"]
57+
key_permissions = ["get", "list"]
58+
secret_permissions = ["get", "list"]
59+
certificate_permissions = ["get", "import", "list"]
60+
storage_permissions = ["backup", "get", "list", "recover"]
61+
},
62+
63+
# Access policies for Azure AD Service Principlas
64+
# To enable this feature, provide a list of Azure AD SPN and set permissions as required.
65+
{
66+
azure_ad_service_principal_names = ["azure-ad-dev-sp1", "azure-ad-dev-sp2"]
67+
key_permissions = ["get", "list"]
68+
secret_permissions = ["get", "list"]
69+
certificate_permissions = ["get", "import", "list"]
70+
storage_permissions = ["backup", "get", "list", "recover"]
71+
}
72+
]
73+
74+
# Create a required Secrets as per your need.
75+
# When you Add `usernames` with empty password this module creates a strong random password
76+
# use .tfvars file to manage the secrets as variables to avoid security issues.
77+
secrets = {
78+
"message" = "Hello, world!"
79+
"vmpass" = ""
80+
}
81+
82+
# Creating Private Endpoint requires, VNet name and address prefix to create a subnet
83+
# By default this will create a `privatelink.vaultcore.azure.net` DNS zone.
84+
# To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name
85+
enable_private_endpoint = true
86+
existing_vnet_id = data.azurerm_virtual_network.example.id
87+
existing_subnet_id = data.azurerm_subnet.example.id
88+
# existing_private_dns_zone = "demo.example.com"
89+
90+
# (Optional) To enable Azure Monitoring for Azure Application Gateway
91+
# (Optional) Specify `storage_account_id` to save monitoring logs to storage.
92+
log_analytics_workspace_id = var.log_analytics_workspace_id
93+
#storage_account_id = var.storage_account_id
94+
95+
# Adding additional TAG's to your Azure resources
96+
tags = {
97+
ProjectName = "demo-project"
98+
Env = "dev"
99+
Owner = "[email protected]"
100+
BusinessUnit = "CORP"
101+
ServiceClass = "Gold"
102+
}
103+
}
104+
```
105+
106+
## Terraform Usage
107+
108+
To run this example you need to execute following Terraform commands
109+
110+
```hcl
111+
terraform init
112+
terraform plan
113+
terraform apply
114+
```
115+
116+
Run `terraform destroy` when you don't need these resources.

‎examples/keyvault_private_end_point_with_existing_VNet_Subnet/main.tf‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
# Azurerm Provider configuration
2+
provider "azurerm" {
3+
features {}
4+
}
5+
6+
data "azurerm_virtual_network" "example" {
7+
name = "vnet-shared-hub-westeurope-001"
8+
resource_group_name = "rg-shared-westeurope-01"
9+
}
10+
11+
data "azurerm_subnet" "example" {
12+
name = "snet-private-ep"
13+
virtual_network_name = data.azurerm_virtual_network.example.name
14+
resource_group_name = data.azurerm_virtual_network.example.resource_group_name
15+
}
16+
17+
module "key-vault" {
18+
source = "kumarvna/key-vault/azurerm"
19+
version = "2.2.0"
20+
21+
# By default, this module will not create a resource group and expect to provide
22+
# a existing RG name to use an existing resource group. Location will be same as existing RG.
23+
# set the argument to `create_resource_group = true` to create new resrouce.
24+
resource_group_name = "rg-shared-westeurope-01"
25+
key_vault_name = "demo-project-shard"
26+
key_vault_sku_pricing_tier = "premium"
27+
28+
# Once `Purge Protection` has been Enabled it's not possible to Disable it
29+
# Deleting the Key Vault with `Purge Protection` enabled will schedule the Key Vault to be deleted
30+
# The default retention period is 90 days, possible values are from 7 to 90 days
31+
# use `soft_delete_retention_days` to set the retention period
32+
enable_purge_protection = false
33+
# soft_delete_retention_days = 90
34+
35+
# Access policies for users, you can provide list of Azure AD users and set permissions.
36+
# Make sure to use list of user principal names of Azure AD users.
37+
access_policies = [
38+
{
39+
azure_ad_user_principal_names = ["[email protected]", "[email protected]"]
40+
key_permissions = ["get", "list"]
41+
secret_permissions = ["get", "list"]
42+
certificate_permissions = ["get", "import", "list"]
43+
storage_permissions = ["backup", "get", "list", "recover"]
44+
},
45+
46+
# Access policies for AD Groups
47+
# to enable this feature, provide a list of Azure AD groups and set permissions as required.
48+
{
49+
azure_ad_group_names = ["ADGroupName1", "ADGroupName2"]
50+
key_permissions = ["get", "list"]
51+
secret_permissions = ["get", "list"]
52+
certificate_permissions = ["get", "import", "list"]
53+
storage_permissions = ["backup", "get", "list", "recover"]
54+
},
55+
56+
# Access policies for Azure AD Service Principlas
57+
# To enable this feature, provide a list of Azure AD SPN and set permissions as required.
58+
{
59+
azure_ad_service_principal_names = ["azure-ad-dev-sp1", "azure-ad-dev-sp2"]
60+
key_permissions = ["get", "list"]
61+
secret_permissions = ["get", "list"]
62+
certificate_permissions = ["get", "import", "list"]
63+
storage_permissions = ["backup", "get", "list", "recover"]
64+
}
65+
]
66+
67+
# Create a required Secrets as per your need.
68+
# When you Add `usernames` with empty password this module creates a strong random password
69+
# use .tfvars file to manage the secrets as variables to avoid security issues.
70+
secrets = {
71+
"message" = "Hello, world!"
72+
"vmpass" = ""
73+
}
74+
75+
# Creating Private Endpoint requires, VNet name and address prefix to create a subnet
76+
# By default this will create a `privatelink.vaultcore.azure.net` DNS zone.
77+
# To use existing private DNS zone specify `existing_private_dns_zone` with valid zone name
78+
enable_private_endpoint = true
79+
existing_vnet_id = data.azurerm_virtual_network.example.id
80+
existing_subnet_id = data.azurerm_subnet.example.id
81+
# existing_private_dns_zone = "demo.example.com"
82+
83+
# (Optional) To enable Azure Monitoring for Azure Application Gateway
84+
# (Optional) Specify `storage_account_id` to save monitoring logs to storage.
85+
log_analytics_workspace_id = var.log_analytics_workspace_id
86+
#storage_account_id = var.storage_account_id
87+
88+
# Adding additional TAG's to your Azure resources
89+
tags = {
90+
ProjectName = "demo-project"
91+
Env = "dev"
92+
Owner = "[email protected]"
93+
BusinessUnit = "CORP"
94+
ServiceClass = "Gold"
95+
}
96+
}

‎examples/keyvault_private_end_point_with_existing_VNet_Subnet/output.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
output "key_vault_id" {
2+
description = "The ID of the Key Vault."
3+
value = module.key-vault.key_vault_id
4+
}
5+
6+
output "key_vault_name" {
7+
description = "Name of key vault created."
8+
value = module.key-vault.key_vault_name
9+
}
10+
11+
output "key_vault_uri" {
12+
description = "The URI of the Key Vault, used for performing operations on keys and secrets."
13+
value = module.key-vault.key_vault_uri
14+
}
15+
16+
output "secrets" {
17+
description = "A mapping of secret names and URIs."
18+
value = module.key-vault.secrets
19+
}
20+
21+
output "Key_vault_references" {
22+
description = "A mapping of Key Vault references for App Service and Azure Functions."
23+
value = module.key-vault.Key_vault_references
24+
}
25+
26+
output "key_vault_private_endpoint" {
27+
description = "The ID of the Key Vault Private Endpoint"
28+
value = module.key-vault.key_vault_private_endpoint
29+
}
30+
31+
output "key_vault_private_dns_zone_domain" {
32+
description = "DNS zone name for Key Vault Private endpoints dns name records"
33+
value = module.key-vault.key_vault_private_dns_zone_domain
34+
}
35+
36+
output "key_vault_private_endpoint_ip_addresses" {
37+
description = "Key Vault private endpoint IPv4 Addresses"
38+
value = module.key-vault.key_vault_private_endpoint_ip_addresses
39+
}
40+
41+
output "key_vault_private_endpoint_fqdn" {
42+
description = "Key Vault private endpoint FQDN Addresses"
43+
value = module.key-vault.key_vault_private_endpoint_fqdn
44+
}

‎examples/complete/variables.tf‎ renamed to ‎examples/keyvault_private_end_point_with_existing_VNet_Subnet/variables.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
variable "log_analytics_workspace_id" {
2-
description = "Specifies the ID of a Log Analytics Workspace where Diagnostics Data to be sent"
3-
default = null
4-
}
5-
6-
variable "storage_account_id" {
7-
description = "The name of the storage account to store the all monitoring logs"
8-
default = null
9-
}
1+
variable "log_analytics_workspace_id" {
2+
description = "Specifies the ID of a Log Analytics Workspace where Diagnostics Data to be sent"
3+
default = null
4+
}
5+
6+
variable "storage_account_id" {
7+
description = "The name of the storage account to store the all monitoring logs"
8+
default = null
9+
}

0 commit comments

Comments
 (0)