{"id":18578865,"url":"https://github.com/libre-devops/terraform-azurerm-keyvault","last_synced_at":"2026-05-02T02:34:15.786Z","repository":{"id":118714425,"uuid":"494426073","full_name":"libre-devops/terraform-azurerm-keyvault","owner":"libre-devops","description":"A module used to deploy an Azure key vault, based on some parameters","archived":false,"fork":false,"pushed_at":"2025-05-14T14:50:06.000Z","size":74,"stargazers_count":1,"open_issues_count":0,"forks_count":1,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-03-01T05:04:45.133Z","etag":null,"topics":["azurerm","azurerm-terraform-provider","module","terraform","terraform-module"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/libre-devops.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-05-20T10:47:53.000Z","updated_at":"2025-05-14T14:50:08.000Z","dependencies_parsed_at":null,"dependency_job_id":"8d8de4f7-cf58-46e8-98fb-793a414a4857","html_url":"https://github.com/libre-devops/terraform-azurerm-keyvault","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":"libre-devops/terraform-module-template","purl":"pkg:github/libre-devops/terraform-azurerm-keyvault","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-keyvault","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-keyvault/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-keyvault/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-keyvault/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/libre-devops","download_url":"https://codeload.github.com/libre-devops/terraform-azurerm-keyvault/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/libre-devops%2Fterraform-azurerm-keyvault/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32521059,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-02T01:12:54.858Z","status":"online","status_checked_at":"2026-05-02T02:00:05.923Z","response_time":132,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azurerm","azurerm-terraform-provider","module","terraform","terraform-module"],"created_at":"2024-11-06T23:38:04.617Z","updated_at":"2026-05-02T02:34:15.757Z","avatar_url":"https://github.com/libre-devops.png","language":"PowerShell","funding_links":[],"categories":[],"sub_categories":[],"readme":"```hcl\ndata \"azurerm_client_config\" \"current_client\" {\n  count = var.use_current_client == true ? 1 : 0\n}\n\nresource \"azurerm_key_vault_access_policy\" \"client_access\" {\n  count        = var.use_current_client == true \u0026\u0026 var.give_current_client_full_access == true ? 1 : 0\n  key_vault_id = azurerm_key_vault.keyvault[0].id # Adjust index based on which key vault the policy should apply to\n  tenant_id    = element(data.azurerm_client_config.current_client.*.tenant_id, 0)\n  object_id    = element(data.azurerm_client_config.current_client.*.object_id, 0)\n\n  key_permissions         = tolist(var.full_key_permissions)\n  secret_permissions      = tolist(var.full_secret_permissions)\n  certificate_permissions = tolist(var.full_certificate_permissions)\n  storage_permissions     = tolist(var.full_storage_permissions)\n}\n\nresource \"azurerm_key_vault\" \"keyvault\" {\n  for_each = { for vault, key_vault in var.key_vaults : vault =\u003e key_vault }\n\n  name                            = each.value.name\n  location                        = each.value.location\n  resource_group_name             = each.value.rg_name\n  sku_name                        = lower(each.value.sku_name)\n  tenant_id                       = var.use_current_client == true ? data.azurerm_client_config.current_client[0].tenant_id : each.value.tenant_id\n  enabled_for_deployment          = each.value.enabled_for_deployment\n  enabled_for_disk_encryption     = each.value.enabled_for_disk_encryption\n  enabled_for_template_deployment = each.value.enabled_for_template_deployment\n  enable_rbac_authorization       = each.value.enable_rbac_authorization\n  purge_protection_enabled        = each.value.purge_protection_enabled\n  soft_delete_retention_days      = each.value.soft_delete_retention_days\n  public_network_access_enabled   = each.value.public_network_access_enabled\n\n  dynamic \"access_policy\" {\n    for_each = each.value.access_policy != null ? each.value.access_policy : []\n    content {\n      tenant_id = access_policy.value.tenant_id\n      object_id = access_policy.value.object_id\n\n      key_permissions     = access_policy.value.key_permissions\n      secret_permissions  = access_policy.value.secret_permissions\n      storage_permissions = access_policy.value.storage_permissions\n    }\n  }\n\n  dynamic \"network_acls\" {\n    for_each = each.value.network_acls != null ? [each.value.network_acls] : []\n    content {\n      bypass                     = network_acls.value.bypass\n      default_action             = title(network_acls.value.default_action)\n      ip_rules                   = network_acls.value.ip_rules\n      virtual_network_subnet_ids = network_acls.value.virtual_network_subnet_ids\n    }\n  }\n\n  tags = each.value.tags\n}\n\nmodule \"diagnostic_settings_custom\" {\n  source = \"github.com/libre-devops/terraform-azurerm-diagnostic-settings\"\n\n  for_each = {\n    for vault, key_vault in var.key_vaults : vault =\u003e key_vault\n    if key_vault.create_diagnostic_settings == true \u0026\u0026 key_vault.diagnostic_settings != null \u0026\u0026 key_vault.diagnostic_settings_enable_all_logs_and_metrics == false\n  }\n\n  diagnostic_settings = merge(\n    each.value.diagnostic_settings,\n    {\n      target_resource_id = azurerm_key_vault.keyvault[each.key].id,\n    }\n  )\n}\n\nmodule \"diagnostic_settings_enable_all\" {\n  source = \"github.com/libre-devops/terraform-azurerm-diagnostic-settings\"\n\n  for_each = {\n    for vault, key_vault in var.key_vaults : vault =\u003e key_vault\n    if key_vault.create_diagnostic_settings == true \u0026\u0026 key_vault.diagnostic_settings_enable_all_logs_and_metrics == true\n  }\n\n  diagnostic_settings = {\n    target_resource_id             = azurerm_key_vault.keyvault[each.key].id\n    law_id                         = try(each.value.diagnostic_settings.law_id, null)\n    diagnostic_settings_name       = \"${azurerm_key_vault.keyvault[each.key].name}-diagnostics\"\n    enable_all_logs                = true\n    enable_all_metrics             = true\n    storage_account_id             = try(each.value.diagnostic_settings.storage_account_id, null)\n    eventhub_name                  = try(each.value.diagnostic_settings.eventhub_name, null)\n    eventhub_authorization_rule_id = try(each.value.diagnostic_settings.eventhub_authorization_rule_id, null)\n    law_destination_type           = each.value.diagnostic_settings.law_destination_type\n    partner_solution_id            = try(each.value.diagnostic_settings.partner_solution_id, null)\n  }\n}\n```\n## Requirements\n\nNo requirements.\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_azurerm\"\u003e\u003c/a\u003e [azurerm](#provider\\_azurerm) | n/a |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_diagnostic_settings_custom\"\u003e\u003c/a\u003e [diagnostic\\_settings\\_custom](#module\\_diagnostic\\_settings\\_custom) | github.com/libre-devops/terraform-azurerm-diagnostic-settings | n/a |\n| \u003ca name=\"module_diagnostic_settings_enable_all\"\u003e\u003c/a\u003e [diagnostic\\_settings\\_enable\\_all](#module\\_diagnostic\\_settings\\_enable\\_all) | github.com/libre-devops/terraform-azurerm-diagnostic-settings | n/a |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [azurerm_key_vault.keyvault](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault) | resource |\n| [azurerm_key_vault_access_policy.client_access](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/key_vault_access_policy) | resource |\n| [azurerm_client_config.current_client](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/data-sources/client_config) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_full_certificate_permissions\"\u003e\u003c/a\u003e [full\\_certificate\\_permissions](#input\\_full\\_certificate\\_permissions) | All the available permissions for key access | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"Backup\",\u003cbr/\u003e  \"Create\",\u003cbr/\u003e  \"Delete\",\u003cbr/\u003e  \"DeleteIssuers\",\u003cbr/\u003e  \"Get\",\u003cbr/\u003e  \"GetIssuers\",\u003cbr/\u003e  \"Import\",\u003cbr/\u003e  \"List\",\u003cbr/\u003e  \"ListIssuers\",\u003cbr/\u003e  \"ManageContacts\",\u003cbr/\u003e  \"ManageIssuers\",\u003cbr/\u003e  \"Purge\",\u003cbr/\u003e  \"Recover\",\u003cbr/\u003e  \"Restore\",\u003cbr/\u003e  \"SetIssuers\",\u003cbr/\u003e  \"Update\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_full_key_permissions\"\u003e\u003c/a\u003e [full\\_key\\_permissions](#input\\_full\\_key\\_permissions) | All the available permissions for key access | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"Backup\",\u003cbr/\u003e  \"Create\",\u003cbr/\u003e  \"Decrypt\",\u003cbr/\u003e  \"Delete\",\u003cbr/\u003e  \"Encrypt\",\u003cbr/\u003e  \"Get\",\u003cbr/\u003e  \"Import\",\u003cbr/\u003e  \"List\",\u003cbr/\u003e  \"Purge\",\u003cbr/\u003e  \"Recover\",\u003cbr/\u003e  \"Restore\",\u003cbr/\u003e  \"Sign\",\u003cbr/\u003e  \"UnwrapKey\",\u003cbr/\u003e  \"Update\",\u003cbr/\u003e  \"Verify\",\u003cbr/\u003e  \"WrapKey\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_full_secret_permissions\"\u003e\u003c/a\u003e [full\\_secret\\_permissions](#input\\_full\\_secret\\_permissions) | All the available permissions for key access | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"Backup\",\u003cbr/\u003e  \"Delete\",\u003cbr/\u003e  \"Get\",\u003cbr/\u003e  \"List\",\u003cbr/\u003e  \"Purge\",\u003cbr/\u003e  \"Recover\",\u003cbr/\u003e  \"Restore\",\u003cbr/\u003e  \"Set\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_full_storage_permissions\"\u003e\u003c/a\u003e [full\\_storage\\_permissions](#input\\_full\\_storage\\_permissions) | All the available permissions for key access | `list(string)` | \u003cpre\u003e[\u003cbr/\u003e  \"Backup\",\u003cbr/\u003e  \"Delete\",\u003cbr/\u003e  \"DeleteSAS\",\u003cbr/\u003e  \"Get\",\u003cbr/\u003e  \"GetSAS\",\u003cbr/\u003e  \"List\",\u003cbr/\u003e  \"ListSAS\",\u003cbr/\u003e  \"Purge\",\u003cbr/\u003e  \"Recover\",\u003cbr/\u003e  \"RegenerateKey\",\u003cbr/\u003e  \"Restore\",\u003cbr/\u003e  \"Set\",\u003cbr/\u003e  \"SetSAS\",\u003cbr/\u003e  \"Update\"\u003cbr/\u003e]\u003c/pre\u003e | no |\n| \u003ca name=\"input_give_current_client_full_access\"\u003e\u003c/a\u003e [give\\_current\\_client\\_full\\_access](#input\\_give\\_current\\_client\\_full\\_access) | If you use your current client as the tenant id, do you wish to give it full access to the keyvault? this aids automation, and is thus enable by default for this module.  Disable for better security by setting to false | `bool` | `false` | no |\n| \u003ca name=\"input_key_vaults\"\u003e\u003c/a\u003e [key\\_vaults](#input\\_key\\_vaults) | A list of key vaults to create | \u003cpre\u003elist(object({\u003cbr/\u003e    name                            = string\u003cbr/\u003e    location                        = string\u003cbr/\u003e    rg_name                         = string\u003cbr/\u003e    sku_name                        = optional(string, \"standard\")\u003cbr/\u003e    tenant_id                       = optional(string)\u003cbr/\u003e    enabled_for_deployment          = optional(bool, true)\u003cbr/\u003e    enabled_for_disk_encryption     = optional(bool, true)\u003cbr/\u003e    enabled_for_template_deployment = optional(bool, true)\u003cbr/\u003e    soft_delete_retention_days      = optional(number)\u003cbr/\u003e    public_network_access_enabled   = optional(bool)\u003cbr/\u003e    enable_rbac_authorization       = optional(bool, true)\u003cbr/\u003e    purge_protection_enabled        = optional(bool, false) # Easier for automation\u003cbr/\u003e    access_policy = optional(list(object({\u003cbr/\u003e      tenant_id           = string\u003cbr/\u003e      object_id           = string\u003cbr/\u003e      key_permissions     = list(string)\u003cbr/\u003e      secret_permissions  = list(string)\u003cbr/\u003e      storage_permissions = list(string)\u003cbr/\u003e    })))\u003cbr/\u003e    network_acls = optional(object({\u003cbr/\u003e      bypass                     = string\u003cbr/\u003e      default_action             = string\u003cbr/\u003e      ip_rules                   = list(string)\u003cbr/\u003e      virtual_network_subnet_ids = list(string)\u003cbr/\u003e    }))\u003cbr/\u003e    contact = optional(list(object({\u003cbr/\u003e      email = string\u003cbr/\u003e      name  = optional(string)\u003cbr/\u003e      phone = optional(string)\u003cbr/\u003e    })))\u003cbr/\u003e    create_diagnostic_settings                      = optional(bool, false)\u003cbr/\u003e    diagnostic_settings_enable_all_logs_and_metrics = optional(bool, false)\u003cbr/\u003e    diagnostic_settings = optional(object({\u003cbr/\u003e      diagnostic_settings_name       = optional(string)\u003cbr/\u003e      storage_account_id             = optional(string)\u003cbr/\u003e      eventhub_name                  = optional(string)\u003cbr/\u003e      eventhub_authorization_rule_id = optional(string)\u003cbr/\u003e      law_id                         = optional(string)\u003cbr/\u003e      law_destination_type           = optional(string, \"Dedicated\")\u003cbr/\u003e      partner_solution_id            = optional(string)\u003cbr/\u003e      enabled_log = optional(list(object({\u003cbr/\u003e        category       = optional(string)\u003cbr/\u003e        category_group = optional(string)\u003cbr/\u003e      })), [])\u003cbr/\u003e      metric = optional(list(object({\u003cbr/\u003e        category = string\u003cbr/\u003e        enabled  = optional(bool, true)\u003cbr/\u003e      })), [])\u003cbr/\u003e      enable_all_logs    = optional(bool, false)\u003cbr/\u003e      enable_all_metrics = optional(bool, false)\u003cbr/\u003e    }), null)\u003cbr/\u003e    tags = map(string)\u003cbr/\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_use_current_client\"\u003e\u003c/a\u003e [use\\_current\\_client](#input\\_use\\_current\\_client) | If you wish to use the current client config or not | `bool` | `true` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_client_access_policy_certificate_permissions\"\u003e\u003c/a\u003e [client\\_access\\_policy\\_certificate\\_permissions](#output\\_client\\_access\\_policy\\_certificate\\_permissions) | The certificate permissions of the client access policy, keyed by Key Vault name. |\n| \u003ca name=\"output_client_access_policy_id\"\u003e\u003c/a\u003e [client\\_access\\_policy\\_id](#output\\_client\\_access\\_policy\\_id) | The ID of the client access policy, keyed by Key Vault name. |\n| \u003ca name=\"output_client_access_policy_key_permissions\"\u003e\u003c/a\u003e [client\\_access\\_policy\\_key\\_permissions](#output\\_client\\_access\\_policy\\_key\\_permissions) | The key permissions of the client access policy, keyed by Key Vault name. |\n| \u003ca name=\"output_client_access_policy_secret_permissions\"\u003e\u003c/a\u003e [client\\_access\\_policy\\_secret\\_permissions](#output\\_client\\_access\\_policy\\_secret\\_permissions) | The secret permissions of the client access policy, keyed by Key Vault name. |\n| \u003ca name=\"output_key_vault_ids\"\u003e\u003c/a\u003e [key\\_vault\\_ids](#output\\_key\\_vault\\_ids) | The IDs of the created Key Vaults, keyed by vault name. |\n| \u003ca name=\"output_key_vault_locations\"\u003e\u003c/a\u003e [key\\_vault\\_locations](#output\\_key\\_vault\\_locations) | The locations of the created Key Vaults, keyed by vault name. |\n| \u003ca name=\"output_key_vault_names\"\u003e\u003c/a\u003e [key\\_vault\\_names](#output\\_key\\_vault\\_names) | The names of the created Key Vaults, keyed by vault name. |\n| \u003ca name=\"output_key_vault_uris\"\u003e\u003c/a\u003e [key\\_vault\\_uris](#output\\_key\\_vault\\_uris) | The uris of the created Key Vaults, keyed by vault name. |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flibre-devops%2Fterraform-azurerm-keyvault","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flibre-devops%2Fterraform-azurerm-keyvault","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flibre-devops%2Fterraform-azurerm-keyvault/lists"}